We have a Cisco 6807-XL that has four 1gb fiber connections to a Fortigate firewall that is not coming up. Both the physical interfaces and the aggregate interface are showing as up on the Fortigate but the Cisco side is showing the etherchannel and physical ports as not connected. It's a pretty basic LACP config on the Cisco side that I have done with other Cisco switches and Palo Alto firewalls and never had an issue with before. Are there any commands on the Cisco side I can use to troubleshoot? Below is the po interface config and one of the physical interfaces. I have tried active/active and active/passive on the LACP setting but neither has brought it up.
interface Port-channelxy description xxxx switchport switchport mode trunk switchport trunk allowed vlan a, b, c, d, e
interface GigabitEthernet1/2/17 description xxxxxx switchport switchport mode trunk switchport trunk allowed vlan a, b,c, d, e channel-group 30 mode active
>....channel-group 30 mode active - Could you try a : channel-group 30 mode on instead.
M.
-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? ' When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '
What is the difference between active and on for the channel group mode? I have always done either active/active or active passive and it has always worked.
With mode "On," there is no protocol or negotiation. Think of mode "On" as static routes. Anyway, LACP is standard across vendors and should work, if not, try "On" on both sides and test.
Question: Are you connecting one firewall to one switch, or are the 6700s VSS and you have 2 firewalls?
I tried using a Cisco 2960X instead of the 6807 but used the exact same lacp config on the ports. The ports on the Cisco came up this time but showed as i instead of p when I did a sh etherchannel summary and when I did a sh lacp 20 neighbor it gave me flags of sp even though the ports are set to active.
we have about 20 other lacp etherchannels on the 6807 that are up and when i do a sh lacp internal i see some of them have the fast tag (f) and some have the slow tag (s)
