topic Re: Port-channel between FTD and ASR 920 in Network Security

Port-channel between FTD and ASR 920

Danny Dulin — Fri, 16 Jan 2026 17:06:58 GMT

We are having issues establishing a port-channel between an FTD 3110 and ASR 920.

FTD LACP mode is set to "Active" while the ASR is set to "Passive". But it doesn't work.

However, we have seen the FTD 4110 with an LACP mode of "On" and ASR "Passive" work beautifully.

I know you're thinking, why not just test 3110 with "On".

Right now the 4110 is in production while the 3110's are not. We attempted a migration last night to the 3110's but couldn't get the port-channel to come up. It wasn't until today that I discovered that I assumed the 4110's were set to "Active"

So thought I'd ask if somebody has experienced this before I try another maintenance window.

Port-Channel between Firepower Threat Defense and ASR 920

Danny Dulin — Fri, 16 Jan 2026 17:04:34 GMT

Re: Port-channel between FTD and ASR 920

balaji.bandi — Fri, 16 Jan 2026 17:35:14 GMT

Most cases that should work (I have used switch and FTD, all good, active on both sides)

Why not try ASR side active? What code is running on the ASR side? Some cases have seen that they are suspended when coming as a standalone. What was your case? Try LACP active and check.

Also, check speed negotiation (always verify and post show ether summary)

Re: Port-channel between FTD and ASR 920

Mark Elsen — Fri, 16 Jan 2026 17:35:56 GMT

- @Danny Dulin Check logs on both devices when trying to make the port-channel.
Various troubleshooting commands mentioned in https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/215351-configure-verify-and-troubleshoot-port.html
will be useful for your problem too

Re: Port-channel between FTD and ASR 920

Cristian Matei — Mon, 19 Jan 2026 08:54:36 GMT

Hi,

Running passive mode on side A (which means LACP negotiation) and on mode on side B (which means no negotiation), even if it works, which is kind of weird, should absolutely NOT be a setup to move on with; this simply should now work.

Run active / active as preferred option, if it doesn't work, run on / on. Use the following document to guide you in the troubleshooting process: https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/215351-configure-verify-and-troubleshoot-port.html

From my experience, having seen this kind of behaviour in the past, it was a bug in FX-OS, fixed via FX-OS upgrade.

Thanks,

Cristian.

Re: Port-channel between FTD and ASR 920

Danny Dulin — Tue, 20 Jan 2026 14:33:06 GMT

@Cristian Matei

Turns out it is possible that the ASR is actually set to "On" which explains why it works with the 4110s.

I don't have access or much knowledge of an ASR, so could you answer the following?

If LACP is configured on an interface we should see one of the two below correct?

channel-group 1 mode active
or

channel-group 1 mode passive

If "On" is configured for the Port-Channel it we would see the following correct?

The ASR documentation that specifies how to configure LACP but doesn't actually talk about "On".
Does this mean that the ASR cannot do "On"?

Or does this mean that the only negotiation protocol ASR can do is LACP?

It seems that all devices that can do port-channels will always have the option for "On".

channel-group 12 (no mode listed)

Re: Port-channel between FTD and ASR 920

Cristian Matei — Tue, 20 Jan 2026 21:22:53 GMT

Hi,

@Danny Dulin Active or Passive means LACP, so there is negotiation. On mode on one side requires On mode on the other side as well, as there is no negotiation. channel-group x mode on should be supported on the ASR; and yes, on mode is always there as an option, don't recall not seeing it as an option.

Thanks,

Cristian.