LACP Aggregate Port Issue – Mismatch actor key

[cb03]

We are trying to configure Link aggregation in Fortigate with downstream Cisco Nexus device which is in VPC.

The connection is as follows:

FortiGate Aggregate Interface
├── port40 <--> Nexus1 Eth1/20 --> vpc 11
└── port44 <--> Nexus2 Eth1/19 --> vpc 11

LACP flags: (A|P)(S|F)(A|I)(I|O)(E|D)(E|D)
(A|P) - LACP mode is Active or Passive
(S|F) - LACP speed is Slow or Fast
(A|I) - Aggregatable or Individual
(I|O) - Port In sync or Out of sync
(E|D) - Frame collection is Enabled or Disabled
(E|D) - Frame distribution is Enabled or Disabled

status: up
npu: n
flush: n
asic helper: y
ports: 2
link-up-delay: 50ms
min-links: 1
ha: master
distribution algorithm: L4
LACP mode: active
LACP speed: slow
LACP HA: enable
aggregator ID: 5
actor key: 97
actor MAC address: e8:1c:ba:c4:5b:f3
partner key: 32779
partner MAC address: 00:23:04:ee:be:0a

member: port40
index: 0
link status: up
link failure count: 3
permanent MAC addr: e8:1c:ba:c4:5b:f3
LACP state: established
LACPDUs RX/TX: 81/130
actor state: ASAIEE
actor port number/key/priority: 1 97 255
partner state: ASAIEE
partner port number/key/priority: 16717 32779 32768
partner system: 32667 00:23:04:ee:be:0a
aggregator ID: 5
speed/duplex: 10000 1
RX state: CURRENT 6
MUX state: COLLECTING_DISTRIBUTING 4

member: port44
index: 1
link status: up
link failure count: 5
permanent MAC addr: e8:1c:ba:c4:5c:17
LACP state: negotiating
LACPDUs RX/TX: 82/165
actor state: ASAODD
actor port number/key/priority: 2 33 255
partner state: ASAIDD
partner port number/key/priority: 329 32779 32768
partner system: 32667 00:23:04:ee:be:0a
aggregator ID: 6
speed/duplex: 10000 1
RX state: CURRENT 6
MUX state: WAITING 2

[cb03]

diagnose sniffer packet port44 "ether proto 0X8809" 4 0 l
interfaces=[port44]
filters=[ether proto 0X8809]
pcap_lookupnet: port44: no IPv4 address assigned
2025-05-20 11:57:25.542646 port44 -- 802.3ad LACPDU (65535,E8-1C-BA-C4-5B-F3,0033,0255,0002) ASAIEE (32667,00-23-04-EE-BE-0A,32779,32768,0329) ASAIEE
2025-05-20 11:57:37.277861 port44 -- 802.3ad LACPDU (32667,00-23-04-EE-BE-0A,32779,32768,0329) ASAIEE (65535,E8-1C-BA-C4-5B-F3,0033,0255,0002) ASAIEE
2025-05-20 11:57:55.652649 port44 -- 802.3ad LACPDU (65535,E8-1C-BA-C4-5B-F3,0033,0255,0002) ASAIEE (32667,00-23-04-EE-BE-0A,32779,32768,0329) ASAIEE
2025-05-20 11:58:07.283377 port44 -- 802.3ad LACPDU (32667,00-23-04-EE-BE-0A,32779,32768,0329) ASAIEE (65535,E8-1C-BA-C4-5B-F3,0033,0255,0002) ASAIEE
2025-05-20 11:58:25.712653 port44 -- 802.3ad LACPDU (65535,E8-1C-BA-C4-5B-F3,0033,0255,0002) ASAIEE (32667,00-23-04-EE-BE-0A,32779,32768,0329) ASAIEE
2025-05-20 11:58:37.288738 port44 -- 802.3ad LACPDU (32667,00-23-04-EE-BE-0A,32779,32768,0329) ASAIEE (65535,E8-1C-BA-C4-5B-F3,0033,0255,0002) ASAIEE

diagnose sniffer packet port40 "ether proto 0X8809" 4 0 l
interfaces=[port40]
filters=[ether proto 0X8809]
pcap_lookupnet: port40: no IPv4 address assigned
2025-05-20 11:59:29.252648 port40 -- 802.3ad LACPDU (65535,E8-1C-BA-C4-5B-F3,0097,0255,0001) ASAODD (32667,00-23-04-EE-BE-0A,32779,32768,16717) ASAIDD
2025-05-20 11:59:41.735607 port40 -- 802.3ad LACPDU (32667,00-23-04-EE-BE-0A,32779,32768,16717) ASAIDD (65535,E8-1C-BA-C4-5B-F3,0097,0255,0001) ASAODD
2025-05-20 11:59:59.342658 port40 -- 802.3ad LACPDU (65535,E8-1C-BA-C4-5B-F3,0097,0255,0001) ASAODD (32667,00-23-04-EE-BE-0A,32779,32768,16717) ASAIDD
2025-05-20 12:00:11.741203 port40 -- 802.3ad LACPDU (32667,00-23-04-EE-BE-0A,32779,32768,16717) ASAIDD (65535,E8-1C-BA-C4-5B-F3,0097,0255,0001) ASAODD
2025-05-20 12:00:29.492664 port40 -- 802.3ad LACPDU (65535,E8-1C-BA-C4-5B-F3,0097,0255,0001) ASAODD (32667,00-23-04-EE-BE-0A,32779,32768,16717) ASAIDD
2025-05-20 12:00:41.746300 port40 -- 802.3ad LACPDU (32667,00-23-04-EE-BE-0A,32779,32768,16717) ASAIDD (65535,E8-1C-BA-C4-5B-F3,0097,0255,0001) ASAODD

I tried doing a failover. Now the port 40 is still negotiating and Port 44 is established.

status: up
npu: n
flush: n
asic helper: y
ports: 2
link-up-delay: 50ms
min-links: 1
ha: master
distribution algorithm: L4
LACP mode: active
LACP speed: slow
LACP HA: enable
aggregator ID: 6
actor key: 33
actor MAC address: e8:1c:ba:c4:5b:f3
partner key: 32779
partner MAC address: 00:23:04:ee:be:0a

member: port40
index: 0
link status: up
link failure count: 10
permanent MAC addr: e8:1c:ba:c4:5b:f3
LACP state: negotiating
LACPDUs RX/TX: 5893/6039
actor state: ASAODD
actor port number/key/priority: 1 97 255
partner state: ASAIDD
partner port number/key/priority: 16717 32779 32768
partner system: 32667 00:23:04:ee:be:0a
aggregator ID: 5
speed/duplex: 10000 1
RX state: CURRENT 6
MUX state: WAITING 2

member: port44
index: 1
link status: up
link failure count: 10
permanent MAC addr: e8:1c:ba:c4:5c:17
LACP state: established
LACPDUs RX/TX: 6019/6156
actor state: ASAIEE
actor port number/key/priority: 2 33 255
partner state: ASAIEE
partner port number/key/priority: 329 32779 32768
partner system: 32667 00:23:04:ee:be:0a
aggregator ID: 6
speed/duplex: 10000 1
RX state: CURRENT 6
MUX state: COLLECTING_DISTRIBUTING 4

As per my understanding the problem that I see is both the ports are sending different Key i.e 33 and 97 this should be same. And the aggregator ID should be same as well.

[cb03]

diagnose sniffer packet port44 "ether proto 0X8809" 4 0 l
interfaces=[port44]
filters=[ether proto 0X8809]
pcap_lookupnet: port44: no IPv4 address assigned
2025-05-20 11:57:25.542646 port44 -- 802.3ad LACPDU (65535,E8-1C-BA-C4-5B-F3,0033,0255,0002) ASAIEE (32667,00-23-04-EE-BE-0A,32779,32768,0329) ASAIEE
2025-05-20 11:57:37.277861 port44 -- 802.3ad LACPDU (32667,00-23-04-EE-BE-0A,32779,32768,0329) ASAIEE (65535,E8-1C-BA-C4-5B-F3,0033,0255,0002) ASAIEE
2025-05-20 11:57:55.652649 port44 -- 802.3ad LACPDU (65535,E8-1C-BA-C4-5B-F3,0033,0255,0002) ASAIEE (32667,00-23-04-EE-BE-0A,32779,32768,0329) ASAIEE
2025-05-20 11:58:07.283377 port44 -- 802.3ad LACPDU (32667,00-23-04-EE-BE-0A,32779,32768,0329) ASAIEE (65535,E8-1C-BA-C4-5B-F3,0033,0255,0002) ASAIEE
2025-05-20 11:58:25.712653 port44 -- 802.3ad LACPDU (65535,E8-1C-BA-C4-5B-F3,0033,0255,0002) ASAIEE (32667,00-23-04-EE-BE-0A,32779,32768,0329) ASAIEE
2025-05-20 11:58:37.288738 port44 -- 802.3ad LACPDU (32667,00-23-04-EE-BE-0A,32779,32768,0329) ASAIEE (65535,E8-1C-BA-C4-5B-F3,0033,0255,0002) ASAIEE

diagnose sniffer packet port40 "ether proto 0X8809" 4 0 l
interfaces=[port40]
filters=[ether proto 0X8809]
pcap_lookupnet: port40: no IPv4 address assigned
2025-05-20 11:59:29.252648 port40 -- 802.3ad LACPDU (65535,E8-1C-BA-C4-5B-F3,0097,0255,0001) ASAODD (32667,00-23-04-EE-BE-0A,32779,32768,16717) ASAIDD
2025-05-20 11:59:41.735607 port40 -- 802.3ad LACPDU (32667,00-23-04-EE-BE-0A,32779,32768,16717) ASAIDD (65535,E8-1C-BA-C4-5B-F3,0097,0255,0001) ASAODD
2025-05-20 11:59:59.342658 port40 -- 802.3ad LACPDU (65535,E8-1C-BA-C4-5B-F3,0097,0255,0001) ASAODD (32667,00-23-04-EE-BE-0A,32779,32768,16717) ASAIDD
2025-05-20 12:00:11.741203 port40 -- 802.3ad LACPDU (32667,00-23-04-EE-BE-0A,32779,32768,16717) ASAIDD (65535,E8-1C-BA-C4-5B-F3,0097,0255,0001) ASAODD
2025-05-20 12:00:29.492664 port40 -- 802.3ad LACPDU (65535,E8-1C-BA-C4-5B-F3,0097,0255,0001) ASAODD (32667,00-23-04-EE-BE-0A,32779,32768,16717) ASAIDD
2025-05-20 12:00:41.746300 port40 -- 802.3ad LACPDU (32667,00-23-04-EE-BE-0A,32779,32768,16717) ASAIDD (65535,E8-1C-BA-C4-5B-F3,0097,0255,0001) ASAODD

Tried doing failover between the ports. Now the Port40 is in Negotiating state and port 44 is in Established state.

status: up
npu: n
flush: n
asic helper: y
ports: 2
link-up-delay: 50ms
min-links: 1
ha: master
distribution algorithm: L4
LACP mode: active
LACP speed: slow
LACP HA: enable
aggregator ID: 6
actor key: 33
actor MAC address: e8:1c:ba:c4:5b:f3
partner key: 32779
partner MAC address: 00:23:04:ee:be:0a

member: port40
index: 0
link status: up
link failure count: 10
permanent MAC addr: e8:1c:ba:c4:5b:f3
LACP state: negotiating
LACPDUs RX/TX: 5914/6059
actor state: ASAODD
actor port number/key/priority: 1 97 255
partner state: ASAIDD
partner port number/key/priority: 16717 32779 32768
partner system: 32667 00:23:04:ee:be:0a
aggregator ID: 5
speed/duplex: 10000 1
RX state: CURRENT 6
MUX state: WAITING 2

member: port44
index: 1
link status: up
link failure count: 10
permanent MAC addr: e8:1c:ba:c4:5c:17
LACP state: established
LACPDUs RX/TX: 6040/6177
actor state: ASAIEE
actor port number/key/priority: 2 33 255
partner state: ASAIEE
partner port number/key/priority: 329 32779 32768
partner system: 32667 00:23:04:ee:be:0a
aggregator ID: 6
speed/duplex: 10000 1
RX state: CURRENT 6
MUX state: COLLECTING_DISTRIBUTING 4

[dingjerry_FTNT]

Try to remove port44 and add it back again.

Also, you may try switching the "set lacp-mode passive/active" setting in the Aggregate interface settings.

[cb03]

Tried removing and adding port44 back again.

And switching the "set lacp-mode passive/active" setting in the Aggregate interface settings.

But no luck