IBM Support

QRadar: Unable to SSH to the appliance after enabling bonding and link aggregation on two interfaces



Running qchange_netsetup to configure bonding on two interfaces resulted in a condition were an SSH session to the appliance was not operating.


Warning is found in /var/log/messages log file:

kernel: bonding: bnd0: Warning: No 802.3ad response from the link partner for any adapters in the bond


This can be caused if the switch does not support IEEE802.3ad Dynamic Link Aggregation.

Diagnosing The Problem

Verify that the bonding mode is set to 4 by running the following command:

cat /etc/modprobe.d/bonding.conf

Unplug the cable from one of the interfaces and try to reconnect to the appliance using an SSH session.

If unplugging one interface cable works, the problem is most likely with the switch. If you experience these symptoms it is important to check that the switch supports 802.3ad and that the ports which you are connecting to are properly configured as a Link Aggregation Group.

Note: The steps required to configure the ports will vary from switch type and manufacturer, so if you are unsure how to configure your switch for Link Aggregation, you should consult with your switch manufacturer for further assistance.

Resolving The Problem

To resolve the issue

  1. Log in to the QRadar UI
  2. Click Admin tab.
  3. Click System and License Management.
  4. Highlight the Appliance that you need to Edit the Bonding Model > click Actions > View and Manage System.

  5. Click Network Interfaces > Highlight the Device to Edit > click Edit

  6. Change mode=4 to mode=0

  7. Click Save.


You should now be able to run an SSH session to the appliance.

Where do you find more information?

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Integrations - 3rd Party","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018