Bond ethernet interfaces for high availability

Updated: September 18, 2026

Want to summarize with AI?

Provides instructions on how to configure link aggregation to ensure network redundancy and continuous connectivity. It outlines how this configuration ensures service continuity by automatically failing over to a backup interface during physical link or switch-related failures.

Cisco ISE supports bonding two ethernet interfaces into a single virtual interface, providing high availability for the physical interfaces. This feature is called Network Interface Card (NIC) bonding or NIC teaming. When two interfaces are bonded, they appear as a single device with one MAC address.

You can use NIC bonding in Cisco ISE only for high availability. It does not support load balancing or link aggregation.

Bonding interfaces ensures that the Cisco ISE services are not affected by:

Physical interface failure
Loss of switch port connectivity due to shutdown or failure
Switch line card failure

When two interfaces are bonded, one becomes the primary interface and the other becomes the backup interface. All traffic flows through the primary interface. If the primary interface fails, the backup interface then routes all traffic. The bond uses the IP address and MAC address of the primary interface.

When you configure the NIC bonding feature, Cisco ISE pairs fixed physical NICs into bonded NICs. The table lists the NIC pairs that can form a bonded interface.

Table 1. Physical NICs bonded together to form an interface
Cisco ISE physical NIC name	Linux physical NIC name	Role in bonded NIC	Bonded NIC name
Gigabit Ethernet 0	Eth0	Primary	bond 0
Gigabit Ethernet 1	Eth1	Backup	bond 0
Gigabit Ethernet 2	Eth2	Primary	bond 1
Gigabit Ethernet 3	Eth3	Backup	bond 1
Gigabit Ethernet 4	Eth4	Primary	bond 2
Gigabit Ethernet 5	Eth5	Backup	bond 2

Supported platforms

You can use the NIC bonding feature on all supported platforms and node personas. The supported platforms are:

SNS hardware appliances—bond 0, 1, and 2.
You can configure bond 0, 1, and 2 on virtual machines if six NICs are available.

Guidelines for bonding ethernet interfaces

As Cisco ISE supports up to six Ethernet interfaces, it can have only three bonds, bond 0, bond 1, and bond 2.
You cannot change the interfaces that are part of a bond or change the role of the interface in a bond. See the above table for information on which NICs can be bonded together and their role in the bond.
The Eth0 or any interface acts as both the management interface as well as the runtime interface. The other interfaces act as runtime interfaces.
Before you create a bond, the primary interface (primary NIC) must be assigned an IP address. The Eth0 interface must be assigned an IPv4 address before you create bond 0. Similarly, before you create bond 1 and 2, Eth2 and Eth4 interfaces must be assigned an IPv4 or IPv6 address, respectively.
Before you create a bond, if the backup interface (Eth1, Eth3, and Eth5 ) has an IP address assigned, remove the IP address from the backup interface. The backup interface should not be assigned an IP address.
You can choose to create only one bond (bond 0) and allow the rest of the interfaces to remain as is. In this case, bond 0 acts as the management interface and runtime interface, and the rest of the interfaces act as runtime interfaces.
You can change the IP address of the primary interface in a bond. The new IP address is assigned to the bonded interface because it assumes the IP address of the primary interface.
When you remove the bond between two interfaces, the IP address assigned to the bonded interface is assigned back to the primary interface.
If you want to configure the NIC bonding feature on a Cisco ISE node that is part of a deployment, you must deregister the node from the deployment, configure NIC bonding, and then register the node back to the deployment.
If a physical interface that acts as a primary interface in a bond (Eth0, Eth2, or Eth4 interface) has static route configured, the static routes are automatically updated to operate on the bonded interface instead of the physical interface.

Configure NIC bonding

You can configure NIC bonding from the Cisco ISE CLI for bond 0 between Eth0 and Eth1 interfaces.

Before you begin

If a physical interface, such as Eth1, Eth3, or Eth5, serves as a backup and is configured with an IP address, remove the IP address from that interface. Leave the backup interface without an IP address.

Procedure

Log in to Cisco ISE CLI with your administrator account.
Enter configure terminal to enter the configuration mode.
Enter the interface GigabitEthernet 0 command.

Enter the backup interface GigabitEthernet 1 command.

The console displays:


 % Warning: IP address of interface eth1 will be removed once NIC bonding is enabled. Are you sure you want to proceed? Y/N [N]:

Enter Y and press Enter.

After you configure bond 0, Cisco ISE restarts automatically. Wait until all services are running. Enter the show application status ise command from the CLI to check whether all services are running.


ise/admin# configure terminal  
Enter configuration commands, one per line.  End with CNTL/Z.
ise/admin(config)# interface gigabitEthernet 0 
ise/admin(config-GigabitEthernet)# backup interface gigabitEthernet 1 
Changing backup interface configuration may cause ISE services to restart.
Are you sure you want to proceed? Y/N [N]: Y 
Stopping ISE Monitoring & Troubleshooting Log Collector...
Stopping ISE Monitoring & Troubleshooting Log Processor...
ISE PassiveID Service is disabled
ISE pxGrid processes are disabled
Stopping ISE Application Server...
Stopping ISE Certificate Authority Service...
Stopping ISE EST Service...
ISE Sxp Engine Service is disabled
Stopping ISE Profiler Database...
Stopping ISE Indexing Engine...
Stopping ISE Monitoring & Troubleshooting Session Database...
Stopping ISE AD Connector...
Stopping ISE Database processes...
Starting ISE Monitoring & Troubleshooting Session Database...
Starting ISE Profiler Database...
Starting ISE Application Server...
Starting ISE Indexing Engine...
Starting ISE Certificate Authority Service...
Starting ISE EST Service...
Starting ISE Monitoring & Troubleshooting Log Processor...
Starting ISE Monitoring & Troubleshooting Log Collector...
Starting ISE AD Connector...
Note: ISE Processes are initializing. Use 'show application status ise'
      CLI to verify all processes are in running state. 
ise/admin(config-GigabitEthernet)#

Verify NIC bonding configuration

To verify if NIC bonding feature is configured, run the show running-config command from the Cisco ISE CLI. You will see an output similar to this example:


!        
interface GigabitEthernet 0
  ipv6 address autoconfig
  ipv6 enable
  backup interface GigabitEthernet 1
  ip address 192.168.118.214 255.255.255.0
!

In the output, the entry "backup interface GigabitEthernet 1" indicates that NIC bonding is configured on Gigabit Ethernet 0. Gigabit Ethernet 0 is the primary interface, and Gigabit Ethernet 1 is the backup interface. The ADE-OS configuration does not display an IP address for the backup interface in the running configuration. The same IP address is used for both the primary and backup interfaces.

You can also run the show interface command to see the bonded interfaces.


ise/admin# show interface  
bond0: flags=5187<UP,BROADCAST,RUNNING,PRIMARY,MULTICAST>  mtu 1500
        inet 10.126.107.60  netmask 255.255.255.0  broadcast 10.126.107.255
        inet6 fe80::8a5a:92ff:fe88:4aea  prefixlen 64  scopeid 0x20<link>
        ether 88:5a:92:88:4a:ea  txqueuelen 0  (Ethernet)
        RX packets 1726027  bytes 307336369 (293.0 MiB)
        RX errors 0  dropped 844  overruns 0  frame 0
        TX packets 1295620  bytes 1073397536 (1023.6 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

GigabitEthernet 0
        flags=6211<UP,BROADCAST,RUNNING,SUBORDINATE,MULTICAST>  mtu 1500
        ether 88:5a:92:88:4a:ea  txqueuelen 1000  (Ethernet)
        RX packets 1726027  bytes 307336369 (293.0 MiB)
        RX errors 0  dropped 844  overruns 0  frame 0
        TX packets 1295620  bytes 1073397536 (1023.6 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device memory 0xfab00000-fabfffff  

GigabitEthernet 1
        flags=6211<UP,BROADCAST,RUNNING,SUBORDINATE,MULTICAST>  mtu 1500
        ether 88:5a:92:88:4a:ea  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device memory 0xfaa00000-faafffff

Remove NIC bonding

Use the no form of the backup interface command to remove a NIC bond.

Before you begin

Procedure

Log in to Cisco ISE CLI with your administrator account.
Enter configure terminal to enter the configuration mode.
Enter the interface GigabitEthernet 0 command.
Enter the no backup interface GigabitEthernet 1 command.
```
% Notice: Bonded Interface bond 0 has been removed.
```

Enter Y and press Enter.

Bond 0 is now removed. Cisco ISE restarts automatically. Wait until all services are running successfully. Enter the show application status ise command from the CLI to verify that all the services are running.


ise/admin# configure terminal  
Enter configuration commands, one per line.  End with CNTL/Z.
ise/admin(config)# interface gigabitEthernet 0 
ise/admin(config-GigabitEthernet)# no backup interface gigabitEthernet 1

Changing backup interface configuration may cause ISE services to restart.
Are you sure you want to proceed? Y/N [N]: Y 
Stopping ISE Monitoring & Troubleshooting Log Collector...
Stopping ISE Monitoring & Troubleshooting Log Processor...
ISE PassiveID Service is disabled
ISE pxGrid processes are disabled
Stopping ISE Application Server...
Stopping ISE Certificate Authority Service...
Stopping ISE EST Service...
ISE Sxp Engine Service is disabled
Stopping ISE Profiler Database...
Stopping ISE Indexing Engine...
Stopping ISE Monitoring & Troubleshooting Session Database...
Stopping ISE AD Connector...
Stopping ISE Database processes...
Starting ISE Monitoring & Troubleshooting Session Database...
Starting ISE Profiler Database...
Starting ISE Application Server...
Starting ISE Indexing Engine...
Starting ISE Certificate Authority Service...
Starting ISE EST Service...
Starting ISE Monitoring & Troubleshooting Log Processor...
Starting ISE Monitoring & Troubleshooting Log Collector...
Starting ISE AD Connector...
Note: ISE Processes are initializing. Use 'show application status ise'
      CLI to verify all processes are in running state. 
ise/admin(config-GigabitEthernet)#

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.