Fortigate to Cisco Switch issue

[52000cc]

When connecting the Fortigate to the Cisco switch, I noticed that the LAG port on the Fortigate is consistently down.Do you know how to resolve this issue? Thank you.

Below are the Fortigate details

config system interface
edit "to-Cisco"
set vdom "root"
set ip 192.168.192.2 255.255.255.0
set allowaccess ping fabric
set type aggregate
set member "port5" "port6"
set device-identification enable
set device-user-identification disable
set role lan
set snmp-index 12
next
end
diag netlink aggregate list
List of 802.3ad link aggregation interfaces:
1 name fortilink status down algorithm L4 lacp-mode active
2 name to-Cisco status down algorithm L4 lacp-mode active

diag netlink interface list to-Cisco

if=to-Cisco family=00 type=1 index=19 mtu=1500 link=0 master=0
ref=21 state=start present no_carrier fw_flags=8800 flags=up broadcast master multicast
Qdisc=noqueue hw_addr=00:15:5d:bd:9a:08 broadcast_addr=ff:ff:ff:ff:ff:ff
stat: rxp=92092 txp=5264 rxb=24443268 txb=635935 rxe=0 txe=0 rxd=0 txd=0 mc=92092 collision=0 @ time=1733488413
re: rxl=0 rxo=0 rxc=0 rxf=0 rxfi=0 rxm=0
te: txa=0 txc=0 txfi=0 txh=0 txw=0
misc rxc=0 txc=0
input_type=0 state=7 arp_entry=0 refcnt=21

the Cisco information

interface Port-channel1
description to-Fortigate
switchport trunk native vlan 192
switchport mode trunk

interface GigabitEthernet1/0/23
switchport trunk native vlan 192
switchport mode trunk
channel-protocol lacp
channel-group 1 mode active

interface GigabitEthernet1/0/24
switchport trunk native vlan 192
switchport mode trunk
channel-protocol lacp
channel-group 1 mode active
interface Vlan192
ip address 192.168.192.1 255.255.255.0

[dingjerry_FTNT]

Hi @52000cc ,

actor state: ASAIDD
actor port number/key/priority: 1 17 255
partner state: ASIODD
partner port number/key/priority: 1 1 255

The third letter indicated whether it is an aggregate or individual interface or not.  Apparently,  FGT is 'A', it means it is an aggregate interface (LACP)

Partner (Cisco switch) is 'I', this is the info FGT received from Cisco switch.

That indicated that there was something wrong with the Cisco switch.  Please check it over there.

[dingjerry_FTNT]

BTW, in the outputs of "diag netlink interface list port5 port6", both port5 and port6 have the same hardware MAC address.  This is weird.

And the outputs of "diag netlink aggregate name to-Cisco" do not have the full outputs.

[52000cc]

I just remove all the lacp related conf and do again, found the port6 cannot be set as the memeber;

edit to-Cisco

set member port5 port6
node_check_object fail! for interface-name port6

value parse error before 'port6'
Command fail. Return code -651

re run the command again 

diag netlink aggregate name to-Cisco
LACP flags: (A|P)(S|F)(A|I)(I|O)(E|D)(E|D)
(A|P) - LACP mode is Active or Passive
(S|F) - LACP speed is Slow or Fast
(A|I) - Aggregatable or Individual
(I|O) - Port In sync or Out of sync
(E|D) - Frame collection is Enabled or Disabled
(E|D) - Frame distribution is Enabled or Disabled

status: down
npu: n
flush: n
asic helper: y
ports: 1
link-up-delay: 50ms
min-links: 1
ha: master
distribution algorithm: L4
LACP mode: active
LACP speed: slow
LACP HA: enable
aggregator ID: 1
actor key: 17
actor MAC address: 00:15:5d:bd:9a:08
partner key: 1
partner MAC address: 00:00:00:00:00:00

member: port5
index: 0
link status: up
link failure count: 0
permanent MAC addr: 00:15:5d:bd:9a:08
LACP state: negotiating
LACPDUs RX/TX: 0/8
actor state: ASAIDD
actor port number/key/priority: 1 17 255
partner state: ASIODD
partner port number/key/priority: 1 1 255
partner system: 65535 00:00:00:00:00:00
aggregator ID: 1
speed/duplex: 1000 1
RX state: DEFAULTED 5
MUX state: ATTACHED 3

[dingjerry_FTNT]

Hi @52000cc ,

Please run this command to see where the port6 is used:

diagnose sys cmdb refcnt show system.interface.name port6

[52000cc]

here is the result
diagnose sys cmdb refcnt show system.interface.name port6
entry used in table firewall.on-demand-sniffer:name 'port6_root' entry interface 'port6' (From VDOM: 'root')

[Toshi_Esumi]

I would suggest, at this moment, you try focusing on bringing up LACP between them with one port first. Then, only after that adding the second port on both sides.

I'm assuming Cisco GigabitEthernet1/0/23 is connected to FGT port5. So putting only that port to the LACP then check "diag netlink aggregate name <name>" on FGT and "show lacp (? depending on the type of Cisco SW)" commands on Cisco side.
If one port doesn't work, two ports would never work.

Toshi