# config system interfaceThe following CLI commands can be used to check the ports and LAG (Link Aggregation Group) status.
edit "lacp_ports"
set vdom "root"
set type aggregate
set member "port1" "port2"
set description 'lacp_example'
set lacp-mode active <----- Default.
set lacp-ha-slave enable <----- Default.
set lacp-speed slow <----- Default.
set algorithm L4 <----- Default.
next
end
FGT# diag netlink aggregate name your_aggregate_link
LACP flags: (A|P)(S|F)(A|I)(I|O)(E|D)(E|D)
(A|P) - LACP mode is Active or Passive
(S|F) - LACP speed is Slow or Fast
(A|I) - Aggregatable or Individual
(I|O) - Port In sync or Out of sync
(E|D) - Frame collection is Enabled or Disabled
(E|D) - Frame distribution is Enabled or Disabled
status: upIn this example the aggregator IDs have the same value on both ports and globally (ID=1), this means that both ports are operational in the LAG.
distribution algorithm: L4
LACP mode: active
LACP speed: slow
LACP HA: enable
aggregator ID: 1
ports: 2
actor key: 17
actor MAC address: 00:09:0f:68:35:94
partner key: 17
partner MAC address: 00:09:0f:68:37:d8
slave: port7
status: up
link failure count: 3
permanent MAC addr: 00:09:0f:68:35:94
actor state: ASAIEE
partner state: ASAIEE
aggregator ID: 1
slave: port8
status: up
link failure count: 2
permanent MAC addr: 00:09:0f:68:35:95
actor state: ASAIEE
partner state: ASAIEE
aggregator ID: 1
FGT# diag netlink aggregate name your_aggregate_linkSee from above that port5 is in a different aggregator (2) then the global aggregator ID (1). In this case, only port6 is operational in the LAG.
LACP flags: (A|P)(S|F)(A|I)(I|O)(E|D)(E|D)
(A|P) - LACP mode is Active or Passive
(S|F) - LACP speed is Slow or Fast
(A|I) - Aggregatable or Individual
(I|O) - Port In sync or Out of sync
(E|D) - Frame collection is Enabled or Disabled
(E|D) - Frame distribution is Enabled or Disabled
status: up
distribution algorithm: L3
LACP mode: active
LACP speed: slow
LACP HA: enable
aggregator ID: 1
ports: 1
actor key: 17
actor MAC address: 00:09:0f:71:1f:22
partner key: 45
partner MAC address: 00:0d:66:2f:2b:40
slave: port5
status: up
link failure count: 19
permanent MAC addr: 00:09:0f:71:1f:22
actor state: ASAIDD <----- DISABLED.
partner state: ASIODD <----- OUT OF SYNC / DISABLED.
aggregator ID: 2
slave: port6
status: up
link failure count: 2
permanent MAC addr: 00:09:0f:71:1f:23
actor state: ASAIEE
partner state: ASAIEE
aggregator ID: 1
FGT # diag sniffer packet your_aggregate_linkDst Multicast - Src = lowest MAC of all ports in the LAG - Eth frame type
2.546898 aggreg_link -- 802.3ad LACPDU (65535,00-09-0F-68-37-D8,0017,0255,0002) ASAIEE (65535,00-09-0F-68-35-94,0017,0255,0002) ASAIEE
0x0000 0180 c200 0002 0009 0f68 37d9 8809 0101 .........h7......
# diagnose sniffer packet any "ether proto 0X8809" 6 0 aThe following information should be provided when opening a ticket with TAC Support for an LACP issue:
# diag netlink aggregate name your_aggregate_link- Output of the sniffer trace gathered on the other end (port-mirroring or PCAP).
# diagnose hardware deviceinfo nic <all_interface_in_your_aggregation>
# diag sniff packet your_aggregate_link " " 6 0 l
Related Articles
FortiGate-310B and FortiGate-620B LACP (802.3ad aggregate port) configuration
Technical Note / FAQ: FortiGate and FortiOS support for 802.3ad (LACP - Link Aggregation)
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2023 Fortinet, Inc. All Rights Reserved.