FortiSwitch features configuration

This section describes how to configure global FortiSwitch settings using FortiGate CLI commands. These settings will apply to all of the managed FortiSwitch units. You can also override some of the settings on individual FortiSwitch units.

VLAN configuration

Use Virtual Local Area Networks (VLANs) to logically separate a LAN into smaller broadcast domains. VLANs allow you to define different policies for different types of users and to set finer control on the LAN traffic. (Traffic is only sent automatically within the VLAN. You must configure routing for traffic between VLANs.)

From the FortiGate unit, you can centrally configure and manage VLANs for the managed FortiSwitch units.

In FortiSwitchOS 3.3.0 and later releases, the FortiSwitch supports untagged and tagged frames in FortiLink mode. The switch supports up to 1,023 user-defined VLANs. You can assign a VLAN number (ranging from 14095) to each of the VLANs.

You can configure the default VLAN for each FortiSwitch port as well as a set of allowed VLANs for each FortiSwitch port.

FortiSwitch VLANs display

The WiFi & Switch Controller> FortiSwitch VLANs page displays VLAN information for the managed switches.

Each entry in the VLAN list displays the following information: l Name—name of the VLAN l VLAN ID—the VLAN number l IP/Netmask—address and mask of the subnetwork that corresponds to this VLAN l Access—administrative access settings for the VLAN l Ref—number of configuration objects referencing this VLAN

Enabling and disabling switch-controller access VLANs through the FortiGate unit

Access VLANs are VLANs that aggregate client traffic solely to the FortiGate unit. This prevents direct client-toclient traffic visibility at the layer-2 VLAN layer. Clients can only communicate with the FortiGate unit. After the VLAN configuration

client traffic reaches the FortiGate, the FortiGate unit can then determine whether to allow various levels of access to the client by shifting the client’s network VLAN as appropriate.

NOTE: IPv6 is not supported between clients within a switch-controller access VLAN.

Use enable to allow traffic only to and from the FortiGate and to block FortiSwitch port-to-port traffic on the specified VLAN. Use disable to allow normal traffic on the specified VLAN.

config system interface edit <VLAN name> set switch-controller-access-vlan {enable | disable}

next

end

NOTE: You must configure the proxy ARP with the config system proxy-arp CLI command to be able to use the access VLANs. For example:

config system proxy-arp edit 1 set interface “V100” set ip 1.1.1.1 set end-ip 1.1.1.200

next

end

Creating VLANs

Setting up a VLAN requires you to create the VLAN and assign FortiSwitch ports to the VLAN. You can do this with either the Web GUI or CLI. Using the Web administration GUI

To create the VLAN:

1. Go to WiFi & Switch Controller> FortiSwitch VLANS, select Create New, and change the following settings:

Interface Name	VLAN name
VLAN ID	Enter a number (1-4094)
Color	Choose a unique color for each VLAN, for ease of visual display.
IP/Network Mask	IP address and network mask for this VLAN.

2. Enable DHCP Server and set the IP range.
3. Set the Admission Control options as required.
4. Select OK.

To assign FortiSwitch ports to the VLAN:

1. Go to WiFi & Switch Controller> FortiSwitch Ports.
2. Click the desired port row.
3. Click the Native VLAN column in one of the selected entries to change the native VLAN.

VLAN configuration

4. Select a VLAN from the displayed list. The new value is assigned to the selected ports.
5. Click the + icon in the Allowed VLANs column to change the allowed VLANs.
6. Select one or more of the VLANs (or the value all) from the displayed list. The new value is assigned to the selected port.

Using the FortiSwitch CLI

1. Create the marketing VLAN.

config system interface edit <vlan name> set vlanid <1-4094> set color <1-32>

set interface <FortiLink-enabled interface>

end

2. Set the VLAN’s IP address.

config system interface edit <vlan name> set ip <IP address> <Network mask>

end

3. Enable a DHCP Server.

config system dhcp server edit 1 set default-gateway <IP address> set dns-service default set interface <vlan name> config ip-range set start-ip <IP address> set end-ip <IP address>

end set netmask <Network mask>

Configure MAC address aging interval

end

4. Assign ports to the VLAN.

config switch-controller managed-switch edit <Switch ID> config ports edit <port name> set vlan <vlan name> set allowed-vlans <vlan name> or

set allowed-vlans-all enable

next

end

end

Assign untagged VLANs to a managed FortiSwitch port:

config switch-controller managed-switch edit <managed-switch> config ports edit <port> set untagged-vlans <VLAN-name>

next

end

next

end

Configure MAC address aging interval

Use the following commands to configure how long an inactive MAC address is saved in the FortiSwitch hardware. The range is 10 to 1,000,000 seconds. The default value is 300. After this amount of time, the inactive MAC address is deleted from the FortiSwitch hardware.

config switch-controller global set mac-aging-interval <10 to 1000000>

end

Enable multiple FortiLink interfaces

NOTE: Only the first FortiLink interface has GUI support.

Use the following command to enable or disable multiple FortiLink interfaces.

config switch-controller global set allow-multiple-interfaces {enable | disable}

end

Configure IGMP settings

Use the following command to configure the global IGMP settings.

Configure LLDP profiles

Aging time is the maximum number of seconds that the system will retain a multicast snooping entry. Enter an integer value from 15 to 3600. The default value is 300.

Flood-unknown-multicast controls whether the system will flood unknown multicast messages within the VLAN.

config switch-controller igmp-snooping set aging-time <15-3600>

set flood-unknown-multicast {enable | disable}

end

Configure LLDP profiles

Use the following commands to configure LLDP profiles:

config switch-controller lldp-profile edit <profile number> set 802.1-tlvs port-vlan-id set 802.3-tlvs max-frame-size set auto-isl {enable | disable} set auto-isl-hello-timer <1-30> set auto-isl-port-group <0-9> set auto-isl-receive-timeout <3-90>

set med-tlvs (inventory-management | network-policy)

end

Configure LLDP settings

Use the following commands to configure LLDP settings:

config switch-controller lldp-settings set status < enable | disable >

set tx-hold <int> set tx-interval <int> set fast-start-interval <int>

set management-interface {internal | management} end

Variable	Description
status	Enable or disable
tx-hold	Number of tx-intervals before the local LLDP data expires. Therefore, the packet TTL (in seconds) is tx-hold times tx-interval. The range for txhold is 1 to 16, and the default value is 4.
tx-interval	How often the FortiSwitch transmits the LLDP PDU. The range is 5 to 4095 seconds, and the default is 30 seconds.

Configure LLDP settings

Variable	Description
fast-start-interval	How often the FortiSwitch transmits the first 4 LLDP packets when a link comes up. The range is 2 to 5 seconds, and the default is 2 seconds. Set this variable to zero to disable fast start.
management-interface	Primary management interface to be advertised in LLDP and CDP PDUs.

Create LLDP asset tags for each managed FortiSwitch

You can use the following commands to add an LLDP asset tag for a managed FortiSwitch:

config switch-controller managed-switch edit <fsw> set switch-device-tag <string>

end

Add media endpoint discovery (MED) to an LLDP configuration

You can use the following commands to add media endpoint discovery (MED) features to an LLDP profile:

config switch-controller lldp-profile edit <lldp-profle> config med-network-policy edit guest-voice set status {disable | enable}

next

edit guest-voice-signaling set status {disable | enable}

next

edit guest-voice-signaling set status {disable | enable}

next

edit softphone-voice set status {disable | enable}

next

edit streaming-video set status {disable | enable}

next

edit video-conferencing set status {disable | enable}

next

edit video-signaling set status {disable | enable}

next edit voice set status {disable | enable}

next

edit voice-signaling set status {disable | enable}

end

config custom-tlvs edit <name> set oui <identifier> set subtype <subtype>

Configure the MAC sync interval

set information-string <string>

end

end

Display LLDP information

You can use the following commands to display LLDP information:

diagnose switch-controller dump lldp stats <switch> <port> diagnose switch-controller dump lldp neighbors-summary <switch> diagnose switch-controller dump lldp neighbors-detail <switch>

Configure the MAC sync interval

Use the following commands to configure the global MAC synch interval.

The MAC sync interval is the time interval between MAC synchronizations. The range is 30 to 600 seconds, and the default value is 60.

config switch-controller mac-sync-settings set mac-sync-interval <30-600>

end

Configure STP settings

NOTE: STP is not supported between a FortiGate unit and a FortiSwitch unit in FortiLink mode.

Use the following CLI commands for global STP configuration. This configuration applies to all managed FortiSwitch units:

config switch-controller stp-settings set name <name> set revision <stp revision> set hello-time <hello time> set forward-time <forwarding delay> set max-age <maximum aging time> set max-hops <maximum number of hops>

end

You can override the global STP settings for a FortiSwitch using the following commands:

config switch-controller managed-switch edit <switch-id> config stp-settings set local-override enable

 

Quarantines

Administrators can use MAC addresses to quarantine hosts and users connected to a FortiSwitch unit.

Quarantined MAC addresses are isolated from the rest of the network and LAN by using a separate VLAN.

Quarantining a MAC address

You can use the FortiGate GUI or CLI to quarantine a MAC address.

NOTE: If you have multiple FortiLink interfaces, only the first quarantine VLAN is created successfully (with an IP address of 10.254.254.254). Additional quarantine VLANs will have an empty IP address.

Using the FortiGate GUI

In the FortiGate GUI, the quarantine feature is automatically enabled when you quarantine a host.

1. Select the host to quarantine.
   • Go to Security Fabric > Physical Topology, right-click on a host, and select Quarantine Host on FortiSwitch.
   • Go to Security Fabric > Logical Topology, right-click on a host, and select Quarantine Host on FortiSwitch.
   • Go to FortiView > Sources, right-click on an entry in the Source column, and select Quarantine Host on FortiSwitch.
2. Click Accept to confirm that you want to quarantine the host.

Using the FortiGate CLI

By default, the quarantine feature is enabled. When you upgrade a FortiGate unit from an older to a newer firmware version, the FortiGate unit uses the quarantine feature status from the older configuration. If the quarantine feature was disabled in the older configuration, it will be disabled after the upgrade.

You can add MAC addresses to be quarantined even when the quarantine feature is disabled. The MAC addresses are only quarantined when the quarantine feature is enabled.

config user quarantine set quarantine enable config targets edit <MAC_address>

Quarantines

set description <string>

set tags <tag1 tag2 tag3 …>

next

end

end

Option	Description
MAC_address_1, MAC_ address_2	A layer-2 MAC address in the following format: 12:34:56:aa:bb:cc
string	Optional. A description of the MAC address being quarantined.
tag1 tag2 tag3 …	Optional. A list of arbitrary strings.

For example:

config user quarantine set quarantine enable config targets edit 00:00:00:aa:bb:cc set description “infected by virus” set tags “quarantined”

next

end

end

Viewing quarantine entries

Quarantine entries are created on the FortiGate that is managing the FortiSwitch.

Using the FortiGate GUI

1. Go to Monitor> Quarantine Monitor.
2. Click Quarantined on FortiSwitch.

The Quarantined on FortiSwitch button is only available if a device is detected behind the FortiSwitch unit, which requires Device Detection to be enabled.

Using the FortiGate CLI

Use the following command to view the quarantine list of MAC addresses: show user quarantine

For example: show user quarantine

config user quarantine set quarantine enable config targets

edit 00:11:22:33:44:55 next

edit 00:01:02:03:04:05 next

end

end

When the quarantine feature is enabled on the FortiGate unit, it creates a quarantine VLAN (qtn.<FortiLink_port_ name>) and a quarantine DHCP server (with the quarantine VLAN as default gateway) on the virtual domain. The quarantine VLAN is applied to the allowed and untagged VLANs on all connected FortiSwitch ports.

Use the following command to view the quarantine VLAN: show system interface qtn.<FortiLink_port_name>

For example:

show system interface qtn.port7

config system interface edit “qtn.port7” set vdom “vdom1” set ip 10.254.254.254 255.255.255.0 set description “Quarantine VLAN” set security-mode captive-portal

set replacemsg-override-group “auth-intf-qtn.port7” set device-identification enable set device-identification-active-scan enable set snmp-index 34

set switch-controller-access-vlan enable

set color 6 set interface “port7” set vlanid 4093

next

end

Use the following commands to view the quarantine DHCP server:

show system dhcp server config system dhcp server

edit 2 set dns-service default set default-gateway 10.254.254.254 set netmask 255.255.255.0 set interface “qtn.port7” config ip-range

edit 1 set start-ip 10.254.254.192 set end-ip 10.254.254.253

next

end

set timezone-option default

next end

Quarantines

Use the following command to view how the quarantine VLAN is applied to the allowed and untagged VLANs on all connected FortiSwitch ports: show switch-controller managed-switch

For example: show switch-controller managed-switch

config switch-controller managed-switch edit “FS1D483Z15000036” set fsw-wan1-peer “port7” set fsw-wan1-admin enable set version 1 set dynamic-capability 503 config ports edit “port1” set vlan “vsw.port7” set allowed-vlans “qtn.port7” set untagged-vlans “qtn.port7”

next edit “port2” set vlan “vsw.port7” set allowed-vlans “qtn.port7” set untagged-vlans “qtn.port7”

next edit “port3” set vlan “vsw.port7” set allowed-vlans “qtn.port7” set untagged-vlans “qtn.port7”

next …

end

end

Releasing MAC addresses from quarantine

Using the FortiGate GUI

1. Go to Monitor> Quarantine Monitor.
2. Click Quarantined on FortiSwitch.
3. Right-click on one of the entries and select Delete or Remove All.
4. Click OK to confirm your choice.

Using the FortiGate CLI

Use the following commands to delete a quarantined MAC address:

config user quarantine config targets

delete <MAC_address>

end

When the quarantine feature is disabled, all quarantined MAC addresses are released from quarantine. Use the following commands to disable the quarantine feature:

config user quarantine set quarantine disable end

 

FortiSwitch ports display

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Limiting the number of parallel process for FortiSwitch configuration

Use the following CLI commands to reduce the number of parallel process that the switch controller uses for configuring FortSwitch units: config global config switch-controller system set parallel-process-override enable set parallel-process <1-300>

end end

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Enabling network-assisted device detection

Network-assisted device detection allows the FortiGate unit to use the information about connected devices detected by the managed FortiSwitch unit.

To enable network-assisted device detection on a VDOM:

config switch-controller network-monitor-settings set network-monitoring enable

end

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Changing the admin password on the FortiGate for all managed FortiSwitch units

By default, each FortiSwitch has an admin account without a password. To replace the admin passwords for all FortiSwitch units managed by a FortiGate, use the following commands from the FortiGate CLI:

config switch-controller switch-profile edit default

set login-passwd-override {enable | disable} set login-passwd <password>

next

end

If you had already applied a profile with the override enabled and the password set and then decide to remove the admin password, you need to apply a profile with the override enabled and no password set; otherwise, your previously set password will remain in the FortiSwitch. For example:

config switch-controller switch-profile edit default set login-passwd-override enable unset login-passwd

next

end

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Converting to FortiSwitch standalone mode

Use one of the following commands to convert a FortiSwitch from FortiLink mode to standalone mode so that it will no longer be managed by a FortiGate:

• execute switch-controller factory-reset <switch-id>

This command returns the FortiSwitch to the factory defaults and then reboots the FortiSwitch. If the FortiSwitch is configured for FortiLink auto-discovery, FortiGate can detect and automatically authorize the FortiSwitch. For example:

execute switch-controller factory-reset S1234567890

• execute switch-controller set-standalone <switch-id>

This command returns the FortiSwitch to the factory defaults, reboots the FortiSwitch, and prevents the FortiGate from automatically detecting and authorizing the FortiSwitch. For example: execute switch-controller set-standalone S1234567890

You can disable FortiLink auto-discovery on multiple FortiSwitch units using the following commands:

config switch-controller global set disable-discovery <switch-id>

end

For example:

config switch-controller global set disable-discovery S1234567890

end

You can also add or remove entries from the list of FortiSwitch units that have FortiLink auto-discovery disabled using the following commands:

config switch-controller global append disable-discovery <switch-id> unselect disable-discovery <switch-id>

end

For example:

config switch-controller global append disable-discovery S012345678 unselect disable-discovery S1234567890

end

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Configuring the FortiSwitch management port

If the FortiSwitch model has a dedicated management port, you can configure remote management to the FortiSwitch. In FortiLink mode, the FortiGate is the default gateway, so you need to configure an explicit route for the FortiSwitch management port.

Using the Web administration GUI

1. Go to Network > Static Routes > Create New > Route.
2. Set Destination to Subnet and enter a subnetwork and mask.
3. Set Device to the management interface.
4. Add a Gateway IP address.

Using the FortiSwitch CLI

Enter the following commands:

config router static edit 1 set device mgmt set gateway <router IP address> set dst <router subnet> <subnet mask>

end

end

In the following example, the FortiSwitch management port is connected to a router with IP address 192.168.0.10:

config router static edit 1 set device mgmt set gateway 192.168.0.10 set dst 192.168.0.0 255.255.0.0

end end

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Grouping FortiSwitch units

You can simplify the configuration and management of complex topologies by creating FortiSwitch groups. A group can include one or more FortiSwitch units and you can include different models in a group.

config switch-controller switch-group edit <name> set description <string> set members <serial-number> <serial-number> … end

end

Grouping FortiSwitch units allows you to restart all of the switches in the group instead of individually. For example, you can use the following command to restart all of the FortiSwitch units in a group named my-swgroup: execute switch-controller restart-swtp my-switch-group

Upgrading the firmware of FortiSwitch groups is easier, too, because fewer commands are needed. See Firmware upgrade of stacked or tiered FortiSwitch units on page 52.

Stacking configuration

To set up stacking:

1. Configure the active FortiLink interface on the FortiGate unit.
2. (Optional) Configure the standby FortiLink interface.
3. Connect the FortiSwitch units together, based on your chosen topology.

1. Configure the active FortiLink

Configure the FortiLink interface (as described in the FortiLink configuration using the FortiGate GUIchapter).

When you configure the FortiLink interface, the stacking capability is enabled automatically.

2. Configure the standby FortiLink

Configure the standby FortiLink interface. Depending on your configuration, the standby FortiLink might connect to the same FortiGate unit as the active FortiLink or to a different FortiGate unit.

If the FortiGate unit receives discovery requests from two FortiSwitch units, the link from one FortiSwitch unit will be selected as active, and the link from other FortiSwitch unit will be selected as standby.

If the active FortiLink fails, the FortiGate unit converts the standby FortiLink to active.

3. Connect the FortiSwitch units

Refer to the topology diagrams to see how to connect the FortiSwitch units.

Inter-switch links (ISLs) form automatically between the stacked switches.

The FortiGate unit will discover and authorize all of the FortiSwitch units that are connected. After this, the FortiGate unit is ready to manage all of the authorized FortiSwitch units.

Grouping FortiSwitch units

Disable stacking

To disable stacking, execute the following commands from the FortiGate CLI. In the following example, port4 is the FortiLink interface:

config system interface edit port4 set fortilink-stacking disable

end

end

Firmware upgrade of stacked or tiered FortiSwitch units

In this topology, the core FortiSwitch units are model FS-224D-FPOE, and the access FortiSwitch units are model FS-124D-POE. Because the switches are stacked or tiered, the procedure to update the firmware is simpler. In the following procedure, the four FortiSwitch units are upgraded from 3.6.1 to 3.6.2.

To upgrade the firmware of stacked or tiered FortiSwitch units:

1. Check that all of the FortiSwitch units are connected and which firmware versions they are running. For example:

execute switch-controller get-conn-status

STACK-NAME: FortiSwitch-Stack-port2

SWITCH-ID            VERSION     STATUS               ADDRESS           JOIN-TIME

NAME

S108DV2EJZDAC42F    v3.6.0       Authorized/Up      169.254.2.4        Thu Feb 8 17:07:35 2018

–

S108DV4FQON40Q07    v3.6.0       Authorized/Up      169.254.2.5        Thu Feb 8 17:08:37 2018

–

S108DVBWVLH4QGEB    v3.6.0       Authorized/Up      169.254.2.6        Thu Feb 8 17:09:13 2018

–

S108DVCY19SA0CD8    v3.6.0       Authorized/Up      169.254.2.2        Thu Feb 8 17:04:41 2018

–

S108DVD98KMQGC44* v3.6.0        Authorized/Up      169.254.2.7        Thu Feb 8 17:10:50 2018

–

Grouping

S108DVGGBJLQQO48* v3.6.0 –	Authorized/Up	169.254.2.3	Thu Feb	8 17:06:57 2018
S108DVKM5T2QEA92 v3.6.0 –	Authorized/Up	169.254.2.8	Thu Feb	8 17:11:00 2018
S108DVZX3VTAOO45 v3.6.0 –	Authorized/Up	169.254.2.9	Thu Feb	8 17:11:00 2018
Managed-Switches: 8	UP: 8	DOWN: 0

2. Upload the firmware image for each FortiSwitch model (FS-224D-FPOE and FS-124D-POE) from either an FTP or TFTP server. If you are using a virtual domain (VDOM), you must enter the config global command before entering the upload-swtp-image command. For example:

FG100E4Q16004478 (global) # execute switch-controller upload-swtp-image tftp FSW_124D_POEv3-build0382-FORTINET.out 172.30.12.18

Downloading file FSW_124D_POE-v3-build0382-FORTINET.out from tftp server 172.30.12.18… ################## Image checking …

Image MD5 calculating …

Image Saving S124DP-IMG.swtp … Successful!

File Syncing…

FG100E4Q16004478 (global) # execute switch-controller upload-swtp-image tftp FSW_224D_FPOEv3-build0382-FORTINET.out 172.30.12.18

Downloading file FSW_224D_FPOE-v3-build0382-FORTINET.out from tftp server 172.30.12.18… ###################### Image checking …

Image MD5 calculating …

Image Saving S224DF-IMG.swtp … Successful!

File Syncing…

3. Check which firmware images are available. For example:

FG100E4Q16004478 (root) # execute switch-controller list-swtp-image SWTP Images on AC:

ImageName                  ImageSize(B)    ImageInfo                ImageMTime

S124DP-IMG.swtp           19174985            S124DP-v3.6-build382 Mon Oct 2 14:40:54 2017

S224DF-IMG.swtp     23277106 S224DF-v3.6-build382 Mon Oct 2 14:42:55 2017 4. Stage the firmware image for each FortiSwitch model (FS-224D-FPOE and FS-124D-POE). For example:

FG100E4Q16004478 (root) # execute switch-controller stage-tiered-swtp-image ALL S124DPIMG.swtp

Staged Image Version S124DP-v3.6-build382

FG100E4Q16004478 (root) # execute switch-controller stage-tiered-swtp-image ALL S224DFIMG.swtp

Staged Image Version S224DF-v3.6-build382

5. Check that the correct firmware image is staged for each FortiSwitch unit. For example:

diagnose switch-controller dump network-upgrade status

Running                                       Status       Next boot

__________________ ________________________________________ _________ __________________ _________

VDOM : root

S108DVCY19SA0CD8 S108DV-v3.6.0-build4277,171207 (Interim) (0/0/0) S108DV-v3.7.0build4277,171207 (Interim)

S108DV2EJZDAC42F S108DV-v3.6.0-build4277,171207 (Interim) (0/0/0)

6. Restart the FortiSwitch units after a 2-minute delay. For example:

execute switch-controller restart-swtp-delayed ALL

Grouping FortiSwitch units

7. When the FortiSwitch units are running again, check that they are running the new firmware version. For example:

execute switch-controller get-conn-status

STACK-NAME: FortiSwitch-Stack-port2
SWITCH-ID NAME	VERSION	STATUS	ADDRESS	JOIN-TIME
S108DV2EJZDAC42F –	v3.6.0	Authorized/Up	169.254.2.4	Thu Feb	8 17:07:35 2018
S108DV4FQON40Q07 –	v3.6.0	Authorized/Up	169.254.2.5	Thu Feb	8 17:08:37 2018
S108DVBWVLH4QGEB –	v3.6.0	Authorized/Up	169.254.2.6	Thu Feb	8 17:09:13 2018
S108DVCY19SA0CD8 –	v3.6.0	Authorized/Up	169.254.2.2	Thu Feb	8 17:04:41 2018
S108DVD98KMQGC44* –	v3.6.0	Authorized/Up	169.254.2.7	Thu Feb	8 17:10:50 2018
S108DVGGBJLQQO48* –	v3.6.0	Authorized/Up	169.254.2.3	Thu Feb	8 17:06:57 2018
S108DVKM5T2QEA92 –	v3.6.0	Authorized/Up	169.254.2.8	Thu Feb	8 17:11:00 2018
S108DVZX3VTAOO45 –	v3.6.0	Authorized/Up	169.254.2.9	Thu Feb	8 17:11:00 2018
Managed-Switches: 8		UP: 8	DOWN: 0

 

Transitioning from a FortiLink split interface to a FortiLink MCLAG

Transitioning from a FortiLink split interface to a FortiLink MCLAG

In this topology, the FortiLink split interface connects a FortiLink aggregate interface from one FortiGate unit to two FortiSwitch units.

Note the following:

l This procedure also applies to a FortiGate unit in HA mode. l More links can be added between the FortiGate unit and FortiSwitch unit. l After the MCLAG is set up, only connect the tier-2 FortiSwitch units.

1. Enable the split interface on the FortiLink aggregate interface. By default, the split interface is enabled. For example:

config system interface edit flinksplit1 set ip 169.254.3.1 255.255.255.0 set allowaccess ping capwap https set vlanforward enable set type aggregate set member port4 port5 set lacp-mode static set fortilink enable

set fortilink-split-interface enable

next

end

2. Log into FortiSwitch 2 using the Connect to CLI button in the FortiGate GUI, use the get switch lldp auto-isl-status command to find out the name of the trunk connecting the peer switches, and change the ISL to an ICL. For example:

get switch lldp auto-isl-status

config switch trunk edit <trunk_name> set mclag-icl enable

Transitioning from a FortiLink split interface to a FortiLink MCLAG

next

end

3. Log into FortiSwitch 1 using the Connect to CLI button in the FortiGate GUI, use the get switch lldp auto-isl-status command to find out the name of the trunk connecting the peer switches, and change the ISL to an ICL. For example:

get switch lldp auto-isl-status

config switch trunk edit <trunk_name> set mclag-icl enable

next

end

4. Log into the FortiGate unit and disable the split interface. For example:

config system interface edit flinksplit1 set fortilink-split-interface disable

next

end

5. Enable the LACP active mode.
6. Check that the LAG is working correctly. For example:

diagnose netlink aggregate name <aggregate_name>

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Dual-homed servers connected to FortiLink tier-1 FortiSwitch units using an MCLAG

To configure a multichassis LAG, you need to configure FortiSwitch 1 and FortiSwitch 2 as MCLAG peer switches before creating a two-port LAG. Use the set mclag-icl enable command to create an inter-chassis link (ICL) on each FortiSwitch unit. Then you set up two MCLAGs towards the servers, each MCLAG using one port from each FortiSwitch unit. You must disable the FortiLink split interface for the FortiGate unit.

This topology is supported when the FortiGate unit is in HA mode.

Standalone FortiGate unit with dual-homed FortiSwitch access

Standalone FortiGate unit with dual-homed FortiSwitch access

This network topology provides high port density with two tiers of FortiSwitch units.

Use the set mclag-icl enable command to create an ICL on each FortiSwitch unit.

 

HA-mode FortiGate units with dual-homed FortiSwitch access

HA-mode FortiGate units with dual-homed FortiSwitch access

In HA mode, only one FortiGate is active at a time. If the active FortiGate unit fails, the backup FortiGate unit becomes active.

Use the set mclag-icl enable command to create an ICL on each FortiSwitch unit.

Multi-tiered MCLAG with HA-mode FortiGate

Multi-tiered MCLAG with HA-mode FortiGate units

To configure a multi-tiered MCLAG with HA-mode FortiGate units:

1. Configure FortiSwitch-1 for the tier-1 MCLAG:

config switch trunk edit “D243Z14000288-0” set mode lacp-active set auto-isl 1 set mclag-icl enable set members “port21” “port22”

next edit “__FoRtI1LiNk0__” set mclag enable set members “port24” “port23”

next edit “8DN4K16000360-0” set mode lacp-active set auto-isl 1 set mclag enable set members “port20”

next edit “mclag-core1” set mode lacp-active set auto-isl 1 set mclag enable set members “port1” “port2”

next edit “mclag-core2” set mode lacp-active set auto-isl 1 set mclag enable

Multi-tiered MCLAG with HA-mode FortiGate

set members “port3” “port4”

next end

2. Configure FortiSwitch-2 for the tier-1 MCLAG:

config switch trunk edit “D243Z14000288-0” set mode lacp-active set auto-isl 1 set mclag-icl enable set members “port21” “port22”

next

edit “__FoRtI1LiNk0__” set mclag enable set members “port24” “port23”

next

edit “8DN4K16000360-0” set mode lacp-active set auto-isl 1 set mclag enable set members “port20”

next edit “mclag-core1” set mode lacp-active set auto-isl 1 set mclag enable set members “port1” “port2”

next edit “mclag-core2” set mode lacp-active set auto-isl 1 set mclag enable set members “port3” “port4”

next end

3. Configure the tier-2 MCLAGs. For example, configure FortiSwitch-6 as follows:

config switch trunk edit “8DN3X15000026-0” set mode lacp-active set auto-isl 1 set mclag-icl enable set members “port43” “port44”

next

edit “8EP3X17000051-0” set mode lacp-active set auto-isl 1 set mclag enable set members “port45”

next

edit “_FlInK1_MLAG0_” set mode lacp-active set auto-isl 1 set mclag enable set members “port48” “port47”

next

edit “8EP3X17000069-0” set mode lacp-active set auto-isl 1 set mclag enable set members “port46”

next

end

Multi-tiered MCLAG with HA-mode FortiGate

4. Configure the access FortiSwitch units.

On FortiSwitch-11:

config switch trunk edit “_FlInK1_MLAG0_” set mode lacp-active set auto-isl 1 set mclag enable set members “port48” “port47”

next

end

On FortiSwitch-12:

config switch trunk edit “_FlInK1_MLAG0_” set mode lacp-active set auto-isl 1 set mclag enable set members “port47” “port48”

next end

 

Grouping

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!