Skip to main content
cb03
Explorer
May 18, 2025
Question

LACP Aggregate Port Issue – Mismatch actor key

  • May 18, 2025
  • 3 replies
  • 4544 views

We are trying to configure Link aggregation in Fortigate with downstream Cisco Nexus device which is in VPC.

 

The connection is as follows:

FortiGate Aggregate Interface
├── port40 <--> Nexus1 Eth1/20 --> vpc 11
└── port44 <--> Nexus2 Eth1/19 --> vpc 11

 

LACP flags: (A|P)(S|F)(A|I)(I|O)(E|D)(E|D)
(A|P) - LACP mode is Active or Passive
(S|F) - LACP speed is Slow or Fast
(A|I) - Aggregatable or Individual
(I|O) - Port In sync or Out of sync
(E|D) - Frame collection is Enabled or Disabled
(E|D) - Frame distribution is Enabled or Disabled

status: up
npu: n
flush: n
asic helper: y
ports: 2
link-up-delay: 50ms
min-links: 1
ha: master
distribution algorithm: L4
LACP mode: active
LACP speed: slow
LACP HA: enable
aggregator ID: 5
actor key: 97
actor MAC address: e8:1c:ba:c4:5b:f3
partner key: 32779
partner MAC address: 00:23:04:ee:be:0a

member: port40
index: 0
link status: up
link failure count: 3
permanent MAC addr: e8:1c:ba:c4:5b:f3
LACP state: established
LACPDUs RX/TX: 81/130
actor state: ASAIEE
actor port number/key/priority: 1 97 255
partner state: ASAIEE
partner port number/key/priority: 16717 32779 32768
partner system: 32667 00:23:04:ee:be:0a
aggregator ID: 5
speed/duplex: 10000 1
RX state: CURRENT 6
MUX state: COLLECTING_DISTRIBUTING 4

member: port44
index: 1
link status: up
link failure count: 5
permanent MAC addr: e8:1c:ba:c4:5c:17
LACP state: negotiating
LACPDUs RX/TX: 82/165
actor state: ASAODD
actor port number/key/priority: 2 33 255
partner state: ASAIDD
partner port number/key/priority: 329 32779 32768
partner system: 32667 00:23:04:ee:be:0a
aggregator ID: 6
speed/duplex: 10000 1
RX state: CURRENT 6
MUX state: WAITING 2

 

3 replies

kaman
Staff
Staff
May 18, 2025

Hi cb03,

Please refer to the document below on how to setup LACP between FortiGate and Cisco Switch:


https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-setup-LACP-between-FortiGate-and-Cisco/ta-p/335667

https://community.cisco.com/t5/switching/lacp-between-cisco-and-forti/td-p/3230919


Note:
++A port in active mode can form a port channel successfully with another port that is in active or passive mode.
++A port in passive mode cannot form a port channel successfully with another port that is in passive mode.
++A port in 'ON' mode is not running LACP and cannot form a port channel.


If you have found a solution, please like and accept it to make it easily accessible to others.


Regards,
Aman

cb03
cb03Author
Explorer
May 18, 2025

Thanks for replying. I tried the same exact configuration. But no luck. Fortigate is still sending different key towards the nexus devices.

dingjerry_FTNT
Staff
Staff
May 18, 2025

The port40 has the following info:

actor state: ASAIEE
......
partner state: ASAIEE

......

aggregator ID: 5

 

The actor state (ASAIEE) means the peer interface connected to port40 on FGT is negotiated successfully.

 

However, for port44, we have:

 

actor state: ASAODD
......
partner state: ASAIDD
......
aggregator ID: 6
......
MUX state: WAITING 2

 

The actor states, ASAODD & ASAIDD, tell us something is wrong.

 

Since the Aggregate interface configuration on FGT is really simple, and you connected to two Cisco Nexus devices to form the aggregate interface, please compare the LACP settings on those 2 Nexus devices.

 

If possible, please provide the LACP configurations on 2 Nexus devices.

cb03
cb03Author
Explorer
May 19, 2025

The LACP configurations of the switches are as below:

 

SW1

interface port-channel11
switchport
switchport mode trunk
switchport trunk allowed vlan 40
vpc 11

 

interface Ethernet1/19
switchport
switchport mode trunk
switchport trunk allowed vlan 40
channel-group 11 mode active

 


SW2

interface port-channel11
switchport
switchport mode trunk
switchport trunk allowed vlan 40
vpc 11


interface Ethernet1/20
switchport
switchport mode trunk
switchport trunk allowed vlan 40
channel-group 11 mode active

funkylicious
SuperUser
SuperUser
May 19, 2025

i would double check with LLDP that the FortiGate/Cisco is really connected to those ports.

"jack of all trades, master of none"
cb03
cb03Author
Explorer
June 10, 2025

Tried removing and adding port44 back again.

And switching the "set lacp-mode passive/active" setting in the Aggregate interface settings.

But no luck