XMG1915-18EP (Nebula) – LACP LAG towards MLAG switch pair never synchronizes, continuous LACP flapp

Hi all,

I'm trying to connect an XMG1915-18EP (Nebula-managed, firmware V4.80(ACGQ.4), latest) via an LACP LAG to an MLAG switch pair, and the LAG never comes up with both members. Has anyone successfully run a Zyxel switch against an MLAG/MC-LAG pair, or seen this behavior before?

Setup

• XMG1915-18EP, ports 17 + 18 (SFP+ 10G) in an LACP LAG
• Port 17 goes to MikroTik CRS310 #1, port 18 to MikroTik CRS310 #2 (RouterOS 7.24.5)
• The two MikroTiks run MLAG (IEEE 802.1AX) with a dedicated peer link, MLAG state is "connected"
• Towards the Zyxel, the MLAG pair acts as one LACP system: same system ID (D0:EA:11:DA:AF:B4), same key (15), system priority 65535
• Zyxel ports 17/18: Trunk, PVID 1, Allowed VLANs All, RSTP enabled, storm control and loop guard disabled
• RSTP: MLAG pair is root (priority 4096), Zyxel priority 8192

What happens

• On both MikroTiks, the Zyxel's LACP state shows "Defaulted" + "Expired", without Sync/Collecting/Distributing
• Every now and then it briefly flaps to synchronized, then drops back
• Several LACPDUs per second in both directions, even though slow rate (30 s) is set on both sides, so the LACP state machine seems to renegotiate constantly
• Nebula shows ports 17 and 18 as "Blocking", practically no unicast traffic passes
• Event log shows "STP topology changes" every second
• With only one member active (port 18 disabled), everything works fine. It only breaks with both members up.

LACP status on MikroTik #1 (Zyxel port 17)

port=sfp-sfpplus1 key=15 flags="ATGS----" partner-sys-id=F4:4D:5C:7A:AE:C8
partner-sys-priority=65535 partner-key=3 partner-flags="A-G---FE"

LACP status on MikroTik #2 (Zyxel port 18), alternating between

partner-flags="A-G---FE"   (Defaulted, Expired)
partner-flags="A-GSCD--"   (Sync, Collecting, Distributing)

Flags: A = Activity, T = Short Timeout, G = Aggregation, S = Sync, C = Collecting, D = Distributing, F = Defaulted, E = Expired

LACPDU capture on MikroTik #2 (~3 s excerpt)

TIME    DIR  SRC-MAC            DST-MAC            PROTOCOL
9.405   ->   38:32:7A:57:49:E8  01:80:C2:00:00:02  lacp
9.923   <-   F4:4D:5C:7A:AE:DA  01:80:C2:00:00:02  lacp
10.065  ->   38:32:7A:57:49:E8  01:80:C2:00:00:02  lacp
10.065  <-   F4:4D:5C:7A:AE:DA  01:80:C2:00:00:02  lacp
10.065  <-   F4:4D:5C:7A:AE:DA  01:80:C2:00:00:02  lacp
10.297  <-   F4:4D:5C:7A:AE:DA  01:80:C2:00:00:02  lacp
10.405  ->   38:32:7A:57:49:E8  01:80:C2:00:00:02  lacp
10.923  <-   F4:4D:5C:7A:AE:DA  01:80:C2:00:00:02  lacp
11.065  ->   38:32:7A:57:49:E8  01:80:C2:00:00:02  lacp
...

What I've already tried

1. LACP rate on the MikroTik side changed from fast (1 s) to slow (30 s) to match the Zyxel: no change
2. Storm control on ports 17/18 disabled: no change
3. STP root fixed (MLAG pair 4096, Zyxel 8192): STP is stable now, LACP problem remains
4. Used a different physical port on MikroTik #2 to get different actor port numbers: no change
5. Only one LAG member active: works stably

My suspicion

The Zyxel doesn't seem to accept LACPDUs from two physical chassis with the same system ID and key into one aggregator. Maybe the 802.1AX "port moved" logic kicks in and keeps invalidating the partner info of the other port. For a standard LACP partner, an MLAG pair should be transparent.

Questions

1. Does the XMG1915-18EP support LACP towards an MLAG/MC-LAG partner (two chassis sharing one system ID)?
2. Is this a known issue, and is there a fix or beta firmware?
3. Are there any CLI/Nebula debug commands to see the LACP aggregator state on the Zyxel side?