Fixed. Just created another port-channel and then grouped each firewalls ports into a separate PO. Failover and resumption work as expected.
Hi Team, Hoping someone may be able to offer up some feedback for an issue. I have a pair of S4112's setup with VLT and have created a Port-Channel with E/1/19-/1/1/12 in it - the basic's of the config are in the image below. Over this trunk I have 5 VLAN's and these VLAN's are going to be routed on a pair of Fortigate firewalls in a HA A-P setup. The Fortigate's have a dual WAN setup configured as a virtual-wan interface. I can pull cables and reboot WAN connections and the HA setup works as expected, but when I do a similar batch of tests with the hardware, not so much. [IMAGE] The issue: When i rebooted the Primary firewall it failed over to the passive unit and traffic is not affected, but when the Primary unit comes back up and re-assumes it's role everything fails. This is caused by the LACP connection and whilst all the interfaces are in an up state (obviously they are opposite active-inactive pairs per switch) diagnostics on the firewall shows it is in a negotiating phase.  S4112F-1# show port-channel summary Flags: D - Down I - member up but inactive P - member up and activeU - Up (port-channel) F - Fallback Activated--------------------------------------------------------------------------------Group Port-Channel Type Protocol Member Ports--------------------------------------------------------------------------------13 port-channel13 (U) Eth DYNAMIC 1/1/9(P) 1/1/10(P) 1/1/11(I) 1/1/12(I)1000 port-channel1000 (U) Eth STATIC 1/1/14(P) 1/1/15(P) When the primary firewall goes down the active/inactive pairs swap (as expected) to those of the secondary unit, but when Fortigate's HA see's the Primary unit again it starts passing traffic on the Primary unit, but as the LACP connection has not re-established (dell switch show it still has the connections to the secondary firewall) traffic flow fails as the Fortigate's aggregate interface is down (all vlans come in on this). To resolve this I shutdown port-channel13 on both switches and bring it back up, instantly fixes it. I checked LACP parameters SLOW, FAST, ACTIVE etc etc and they are consistent across all devices. The output from  show lacp port-channel interface port-channel 13 Port-channel 13 admin up, oper up, mode lacpActor System ID: Priority 4096, Address 00:00:00:00:00:03Partner System ID: Priority 65535, Address 70:4c:a5:d1:1c:2aActor Admin Key 13, Oper Key 13, Partner Oper Key 17Fallback: Not configured, Fallback port preemption: Configured, Fallback timeout: 15 secondsFallback Port Elected:LACP LAG ID 13 is an aggregatable linkA - Active LACP, B - Passive LACP, C - Short Timeout, D - Long TimeoutE - Aggregatable Link, F - Individual Link, G - IN_SYNC, H - OUT_OF_SYNC,I - Collection enabled, J - Collection disabled, K - Distribution enabled,L - Distribution disabled, M - Partner Defaulted, N - Partner Non-defaulted,O - Receiver is in expired state, P - Receiver is not in expired statePort ethernet1/1/9 is Enabled, LACP is enabled and mode is lacpActor Admin: State ADEHJLMP Key 13 Priority 32768Oper: State ADEGIKNP Key 13 Priority 32768Partner Admin: State BDEGIKMP Key 0 Priority 0Oper: State ADEGIKNP Key 17 Priority 255Port ethernet1/1/10 is Enabled, LACP is enabled and mode is lacpActor Admin: State ADEHJLMP Key 13 Priority 32768Oper: State ADEGIKNP Key 13 Priority 32768Partner Admin: State BDEGIKMP Key 0 Priority 0Oper: State ADEGIKNP Key 17 Priority 255Port ethernet1/1/11 is Enabled, LACP is enabled and mode isActor Admin: State BDFHJLNP Key PriorityOper: State BDFHJLNP Key PriorityPartner Admin: State BDFHJLNP Key PriorityOper: State BDFHJLNP Key PriorityPort ethernet1/1/12 is Enabled, LACP is enabled and mode isActor Admin: State BDFHJLNP Key PriorityOper: State BDFHJLNP Key PriorityPartner Admin: State BDFHJLNP Key PriorityOper: State BDFHJLNP Key Priority Shows that the connection states are right and a similar output is seen on the firewalls (although this is when the system is working, the LACP State on the Fortigates shows Negotiating) FW1# diagnose netlink aggregate name TRUNK-TO-S4112LACP flags: (A|P)(S|F)(A|I)(I|O)(E|D)(E|D)(A|P) - LACP mode is Active or Passive(S|F) - LACP speed is Slow or Fast(A|I) - Aggregatable or Individual(I|O) - Port In sync or Out of sync(E|D) - Frame collection is Enabled or Disabled(E|D) - Frame distribution is Enabled or Disabled status: upnpu: yflush: nasic helper: yoid: 0ports: 4link-up-delay: 50msmin-links: 1ha: masterdistribution algorithm: L4LACP mode: activeLACP speed: slowLACP HA: enableaggregator ID: 1actor key: 17actor MAC address: 70:4c:a5:d1:1c:2apartner key: 13partner MAC address: 00:00:00:00:00:03 slave: port9index: 0link status: uplink failure count: 1permanent MAC addr: 70:4c:a5:d1:1c:2aLACP state: establishedactor state: ASAIEEactor port number/key/priority: 1 17 255partner state: ASAIEEpartner port number/key/priority: 65 13 32768partner system: 36864 00:00:00:00:00:03aggregator ID: 1speed/duplex: 1000 1RX state: CURRENT 6MUX state: COLLECTING_DISTRIBUTING 4 slave: port10index: 1link status: uplink failure count: 1permanent MAC addr: 70:4c:a5:d1:1c:2bLACP state: establishedactor state: ASAIEEactor port number/key/priority: 2 17 255partner state: ASAIEEpartner port number/key/priority: 66 13 32768partner system: 36864 00:00:00:00:00:03aggregator ID: 1speed/duplex: 1000 1RX state: CURRENT 6MUX state: COLLECTING_DISTRIBUTING 4 slave: port11index: 2link status: uplink failure count: 1permanent MAC addr: 70:4c:a5:d1:1c:2cLACP state: establishedactor state: ASAIEEactor port number/key/priority: 3 17 255partner state: ASAIEEpartner port number/key/priority: 35 13 32768partner system: 36864 00:00:00:00:00:03aggregator ID: 1speed/duplex: 1000 1RX state: CURRENT 6MUX state: COLLECTING_DISTRIBUTING 4 slave: port12index: 3link status: uplink failure count: 1permanent MAC addr: 70:4c:a5:d1:1c:2dLACP state: establishedactor state: ASAIEEactor port number/key/priority: 4 17 255partner state: ASAIEEpartner port number/key/priority: 36 13 32768partner system: 36864 00:00:00:00:00:03aggregator ID: 1speed/duplex: 1000 1RX state: CURRENT 6MUX state: COLLECTING_DISTRIBUTING 4 Hope that makes some sense. Regards, Lee
S4112 trunk to Fortigate Vlan's