Technical Tip: FortiLink connectivity can go down due to LLDP if too many VLAN interfaces are configured (Known Issue in FortiOS v7.6.3 and all older)

LLDP PDUs transmitted by the FortiGate are currently limited to a maximum frame size of 1500 bytes. Typically, these LLDP PDUs are significantly smaller than this, but they can grow in size based on the Type-Length-Values (TLVs) that are included within the PDU.

Notably, one TLV sub-type that can be included in outgoing FortiGate LLDP frames is 'VLAN Name' (TLV Type 127, Organization Code 00:80:c2, Subtype 0x03). This TLV will have one entry for each VLAN sub-interface associated with the FortiGate physical interface that is transmitting the LLDP PDU, which is a common case for FortiLink interfaces used by the FortiGate to manage FortiSwitch interfaces. Consider the following example:

• Interface 'fortilink' is an Aggregate composed of members port1 and port2. The administrator has configured 20 VLANs underneath the FortiLink interface for usage on downstream managed FortiSwitches.
• If LLDP transmission is enabled on FortiLink, then physical members port1 and port2 will transmit LLDP PDUs that include 20 separate 'IEEE 802.1 Chair - VLAN Name' TLVs, one for each VLAN sub-interface. This TLV will include the VLAN identifier/tag and also the FortiGate-assigned name of the VLAN.
• Theoretically, the maximum length of a VLAN sub-interface on the FortiGate is up to 15 characters long, but lab testing of the FortiGate indicates that these 'VLAN Name' TLV entries are only created if the name of the VLAN is 7 characters or shorter (i.e., 'vlan110' would have a TLV entry in LLDP, whereas 'vlan_110' would not). This was observed when testing FortiOS v7.4.8 and v7.6.2.

Critically, each 'VLAN Name' TLV adds several bytes to the total size of the LLDP PDU, but the FortiGate also imposes a maximum frame size of 1500 bytes for LLDP PDUs (regardless of the link MTU setting). If too many VLANs are added to an interface, then it is possible to exceed this LLDP limit and cause the FortiGate to stop transmitting LLDP for that particular interface. For example, configuring approximately 70 VLAN interfaces with names like 'vlan###' is enough to exceed the limit, though having shorter names (like 'vl###') can allow for more VLANs before the limit is exceeded (approximately 90-100).

While this can be an issue on its own, it becomes a very significant issue if this is combined with fortilink-neighbor-detect lldp being configured on a FortiLink-enabled interface. In this case, the FortiSwitch is checking for LLDP frames sent by the FortiGate, and if they are not received on a regular basis, then the FortiGate to FortiSwitch trunk connection will go offline, bringing down FortiLink connectivity.

Recommendation:

This issue impacts all FortiOS versions older than FortiOS v7.6.4 and v8.0.0, though in practice, it has a low likelihood of significant impact due to the multiple factors involved.

In particular, older FortiOS versions did not use fortilink-neighbor-detect lldp by default and instead used the older fortilink-neighbor-detect fortilink method, which does not rely on LLDP functionality. However, this issue is more likely to impact FortiGates running FortiOS v7.6.2 to v7.6.3, specifically since those set fortilink-neighbor-detect lldp as the new default setting for FortiLink (see: Troubleshooting Tip: FortiSwitch in FortiLink goes offline when FortiOS upgraded to v7.6.1 or above).

Additionally, this issue has been resolved as of change #1154361, which fixed the issue in FortiOS v7.6.4, v8.0.0, and all later versions with the following changes:

• LLDP maximum frame sizing on the FortiGate is now based on the interface MTU, rather than a fixed 1500-byte limit.
• LLDP TLVs have been reorganized to ensure that mandatory TLVs are presented first in the frame payload.
• Any non-mandatory TLVs (such as 'VLAN Name') that WOULD cause the max frame size to be exceeded are instead omitted/dropped to ensure that the FortiGate can always transmit an LLDP PDU correctly and within the interface limits.

Note:
If the type of interface used for FortiLink is a 'hardware switch', the command to look for to check if LLDP is in use is as follows:

config system interface

    edit fortilink

        set stp enable

    next

end

If STP is enabled, this implicitly sets the detection method to LLDP instead of FortiLink. See the bottom of this article:
Troubleshooting Tip: FortiSwitch in FortiLink goes offline when FortiOS upgraded to v7.6.1 or above

Related article:

Technical Tip: How to capture LLDP (Link Layer Discovery Protocol) packet in a FortiGate