LACP Etherchannel Between Cisco 6807 and Fortigate firewall not workin

[dbuckley77]

We have a Cisco 6807-XL that has four 1gb fiber connections to a Fortigate firewall that is not coming up.  Both the physical interfaces and the aggregate interface are showing as up on the Fortigate but the Cisco side is showing the etherchannel and physical ports as not connected.  It's a pretty basic LACP config on the Cisco side that I have done with other Cisco switches and Palo Alto firewalls and never had an issue with before.  Are there any commands on the Cisco side I can use to troubleshoot?  Below is the po interface config and one of the physical interfaces.  I have tried active/active and active/passive on the LACP setting but neither has brought it up.


interface Port-channel30
description xxxx
switchport
switchport mode trunk
switchport trunk allowed vlan 250,800,805,811,820,830

interface GigabitEthernet1/2/17
description xxxxxx
switchport
switchport mode trunk
switchport trunk allowed vlan 250,800,805,811,820,830
channel-group 30 mode active

[MHM Cisco World]

Show lacp neighbor 

Share this from SW

MHM

[acampbell]

Hi,

On the 6800 can you try adding

interface GigabitEthernet1/2/17

switchport
switchport mode trunk
switchport trunk allowed vlan 250,800,805,811,820,830

channel-protocol lacp
channel-group 30 mode active

[marce1000]

                         >....channel-group 30 mode  active
  - Could you try a : channel-group 30 mode  on  instead.

  M.

[dbuckley77]

What is the difference between active and on for the channel group mode?  I have always done either active/active or active passive and it has always worked.

[Reza Sharifi]

With mode "On," there is no protocol or negotiation. Think of mode "On" as static routes. Anyway, LACP is standard across vendors and should work, if not, try "On" on both sides and test.

Question: Are you connecting one firewall to one switch, or are the 6700s VSS and you have 2 firewalls?

HTH

[dbuckley77]

I tried using a Cisco 2960X instead of the 6807 but used the exact same lacp config on the ports.  The ports on the Cisco came up this time but showed as i instead of p when I did a sh etherchannel summary and when I did a sh lacp 20 neighbor it gave me flags of sp even though the ports are set to active.

[MHM Cisco World]

check if the 6807 use fast lacp or not 

MHM

[dbuckley77]

how do i check to see if it uses fast lacp

we have about 20 other lacp etherchannels on the 6807 that are up and when i do a sh lacp internal i see some of them have the fast tag (f) and some have the slow tag (s)

[MHM Cisco World]

show lacp internal 
show lacp neighbor 

share both if you can 

MHM