Trunk between Cisco switch and Fortigate using LACP

[teksolutions]

Trying to get a trunk built between a Cisco Catalyst switch and a Forigate 100F using two 10G links in an LCAP link-aggregation configuration.  The LACP link comes up but the VLAN communication does not work.  I swear I've used this same configuration in the past and it worked, but it isn't working now.

Here is the configuration on the Fortigate:

config system interface
    edit "x1"
        set vdom "root"
        set type physical
        set trunk enable
        set snmp-index 7
    next
    edit "x2"
        set vdom "root"
        set type physical
        set trunk enable
        set snmp-index 8
     next
     edit "po1"
        set vdom "root"
        set allowaccess ping https ssh snmp http fgfm radius-acct fabric ftm
        set vlanforward enable
        set type aggregate
        set member "x1" "x2"
        set alias "Trunk to Cisco"
        set device-identification enable
        set lldp-transmission enable
        set role lan
        set snmp-index 100
        config ipv6
            set ip6-allowaccess ping
        end
    next

    edit "po1.vlan10"
        set vdom "root"
        set device-identification enable
        set role lan
        set snmp-index 49
        set interface "po1"
        set vlanid 10
    next
end

Here is the configuration on the Cisco

interface Port-channel1
    description Trunk to Fortigate
    switchport trunk native vlan 10
    switchport mode trunk
    spanning-tree portfast trunk
!
    interface TenGigabitEthernet1/1/1
    switchport trunk native vlan 10
    switchport mode trunk
    logging event bundle-status
    channel-protocol lacp
    channel-group 1 mode active
!
interface TenGigabitEthernet1/1/2
    switchport trunk native vlan 10
    switchport mode trunk
    logging event bundle-status
    channel-protocol lacp
    channel-group 1 mode active
!
interface Vlan10
    ip address 192.168.10.2 255.255.255.0
!

[BSeklecki_GE]

Oh and BTW, I had never thought of it until now, but this is why VLAN#1 should absolutely never be used ANY-Frickin'where, ANY-Frickin'time.

Just make sure that you never disable/shut it down on a Cisco IOS, IOS-XE, or NX-OS switch platform; try to keep to IOS-XR platforms when projects allow for it.

[fbegit]

This seems like a misconfiguration. Probably if you disable offloading this would work. To fix this just run the following and test it again

config system interface
    edit "x1"
        unset trunk 
    next
    edit "x2"
        unset trunk
     next

end

After that please disable and enable Aggregate interface. 

[teksolutions]

Didn't need to unset that after I got rid of the FortiLink BS then everything came up fine.

[GRacine]

On fortigate side, where are you mentioning wich Vlan is allowed on the interface "po1" that can transit on the trunk? example vlan 100, 101, 102, 103, 104. I try to to same thing, but with a regular interface without LACP.

Thansk for any helps !