> Source: [sk184801](https://support.checkpoint.com/results/sk/sk184801)

# sk184801 - "magg0: An illegal loopback occurred on adapter" appears repeatedly in /var/log/messages file on Maestro Security Group Members

| Property | Value |
|----------|-------|
| Solution ID | sk184801 |
| Date Created | 2026-08-17 |
| Last Modified | 2026-08-22 |
| Technical Level | Advanced |
| Products | Scalable Platforms |
| Versions | R82.20, R82.10, R82, R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * These messages appear repeatedly in the `/var/log/messages` file on Security Group Members:
  *

    ```
    kernel: magg0: An illegal loopback occurred on adapter (eth1-Mgmt1)
    kernel: Check the configuration to verify that all adapters are connected to 802.3ad compliant switch ports
    ```

  *

    ```
    kernel: magg0: An illegal loopback occurred on adapter (eth2-Mgmt1)
    kernel: Check the configuration to verify that all adapters are connected to 802.3ad compliant switch ports
    ```

* No traffic impact is observed.

## Cause

Common causes:

<br />

* If this message appears only on the SMO Security Group Member, then it indicates a misconfiguration between the ports on the Security Group and the switches connected to the Uplink ports on the Maestro Orchestrator.
* If this message appears only on the non-SMO Security Group Members, then it is related to how the Maestro Orchestrator handles the Link Aggregation Control Protocol (LACP) traffic on the MAGG bond interfaces.

Explanation:  

<br />

1. The Management bond (magg0) on each Security Group Member uses IEEE 802.3ad (LACP) to communicate with an upstream switch.
2. The SMO Security Group Member sends LACP Data Units (LACPDUs) from its MAGG bond interfaces (eth1-Mgmt1 / eth2-Mgmt1) through the Maestro Orchestrator to the management network.
3. Because LACP uses a multicast MAC address for destination, and these are Management interfaces, the Maestro Orchestrator's internal management switching on the MAGG LAN floods these multicast LACP frames towards the upstream management switches, and across the internal management network to all other Security Group Members.
4. As a result, non?SMO Security Group Members receive LACP frames that originate from the SMO Security Group Member, but at the bonding driver level look similar to traffic they send themselves. From the Gaia OS bonding driver's perspective, this appears as if frames transmitted on an adapter are received back on the same adapter, which is interpreted as an "illegal loopback" condition.

Therefore, the messages on non-SMO Security Group Members indicate a management-plane LACP behavior and do not affect user traffic. The messages are informational. If desired, you can configure management switching to prevent these log entries from being generated.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content