LACP Aggregate Port Issue – Mismatch actor key

[cb03]

We are trying to configure Link aggregation in Fortigate with downstream Cisco Nexus device which is in VPC.

The connection is as follows:

FortiGate Aggregate Interface
├── port40 <--> Nexus1 Eth1/20 --> vpc 11
└── port44 <--> Nexus2 Eth1/19 --> vpc 11

LACP flags: (A|P)(S|F)(A|I)(I|O)(E|D)(E|D)
(A|P) - LACP mode is Active or Passive
(S|F) - LACP speed is Slow or Fast
(A|I) - Aggregatable or Individual
(I|O) - Port In sync or Out of sync
(E|D) - Frame collection is Enabled or Disabled
(E|D) - Frame distribution is Enabled or Disabled

status: up
npu: n
flush: n
asic helper: y
ports: 2
link-up-delay: 50ms
min-links: 1
ha: master
distribution algorithm: L4
LACP mode: active
LACP speed: slow
LACP HA: enable
aggregator ID: 5
actor key: 97
actor MAC address: e8:1c:ba:c4:5b:f3
partner key: 32779
partner MAC address: 00:23:04:ee:be:0a

member: port40
index: 0
link status: up
link failure count: 3
permanent MAC addr: e8:1c:ba:c4:5b:f3
LACP state: established
LACPDUs RX/TX: 81/130
actor state: ASAIEE
actor port number/key/priority: 1 97 255
partner state: ASAIEE
partner port number/key/priority: 16717 32779 32768
partner system: 32667 00:23:04:ee:be:0a
aggregator ID: 5
speed/duplex: 10000 1
RX state: CURRENT 6
MUX state: COLLECTING_DISTRIBUTING 4

member: port44
index: 1
link status: up
link failure count: 5
permanent MAC addr: e8:1c:ba:c4:5c:17
LACP state: negotiating
LACPDUs RX/TX: 82/165
actor state: ASAODD
actor port number/key/priority: 2 33 255
partner state: ASAIDD
partner port number/key/priority: 329 32779 32768
partner system: 32667 00:23:04:ee:be:0a
aggregator ID: 6
speed/duplex: 10000 1
RX state: CURRENT 6
MUX state: WAITING 2

[kaman]

Hi cb03,

Please refer to the document below on how to setup LACP between FortiGate and Cisco Switch:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-setup-LACP-between-FortiGate-and-Ci...

https://community.cisco.com/t5/switching/lacp-between-cisco-and-forti/td-p/3230919

Note:
++A port in active mode can form a port channel successfully with another port that is in active or passive mode.
++A port in passive mode cannot form a port channel successfully with another port that is in passive mode.
++A port in 'ON' mode is not running LACP and cannot form a port channel.

If you have found a solution, please like and accept it to make it easily accessible to others.

Regards,
Aman

[cb03]

Thanks for replying. I tried the same exact configuration. But no luck. Fortigate is still sending different key towards the nexus devices.

[dingjerry_FTNT]

The port40 has the following info:

actor state: ASAIEE
......
partner state: ASAIEE

......

aggregator ID: 5

The actor state (ASAIEE) means the peer interface connected to port40 on FGT is negotiated successfully.

However, for port44, we have:

actor state: ASAODD
......
partner state: ASAIDD
......
aggregator ID: 6
......
MUX state: WAITING 2

The actor states, ASAODD & ASAIDD, tell us something is wrong.

Since the Aggregate interface configuration on FGT is really simple, and you connected to two Cisco Nexus devices to form the aggregate interface, please compare the LACP settings on those 2 Nexus devices.

If possible, please provide the LACP configurations on 2 Nexus devices.

[cb03]

The LACP configurations of the switches are as below:

SW1

interface port-channel11
switchport
switchport mode trunk
switchport trunk allowed vlan 40
vpc 11

interface Ethernet1/19
switchport
switchport mode trunk
switchport trunk allowed vlan 40
channel-group 11 mode active

SW2

interface port-channel11
switchport
switchport mode trunk
switchport trunk allowed vlan 40
vpc 11

interface Ethernet1/20
switchport
switchport mode trunk
switchport trunk allowed vlan 40
channel-group 11 mode active

[funkylicious]

i would double check with LLDP that the FortiGate/Cisco is really connected to those ports.

[cb03]

I have triple checked it.

[Toshi_Esumi]

Unless SW1 and SW2 are stacked, the port-channel11 wouldn't be formed because no communication between them. If you have a doubt, move one of them to the other side so that both ports are on the same switch. Then it should come up with the FGT.

Toshi

[cb03]

Both the switches are in vPC. Therefore the port-channel11 should be formed using vpc 11.

[dingjerry_FTNT]

Hi @cb03 ,

You may capture some sniffer captures on FGT using this CLI:

diagnose sniffer packet any "ether proto 0X8809" 4 0 l

And Also please provide the ARP table from FGT:

get sys arp