Technical Tip: LLDP neighbor limits for FortiOS

Description

This article explains the LLDP neighbor limits for FortiOS and how the device behaves when these limits are exceeded.

  Scope

FortiOS v7.2+.

Solution

LLDP protocol can be used by any device in a LAN segment to advertise its presence and its capabilities.

When LLDP reception is enabled, FortiGate devices can process incoming LLDP packets and store details about neighboring devices. For example: 

In FortiOS 7.6.2 and earlier:

diagnose lldprx neighbor summary 
1 port 'b' 14 mac 84:39:8F:90:95:41 chassis 84:39:8F:90:95:40 port 'b' system 'FGT-1'

Important note:

From FortiOS 7.6.3, this command has been updated to 'diagnose lldp rx neighbor summary', with a space between lldp and rx. Refer to: FortiOS 7.6.3 - diagnose lldp

diagnose lldp rx neighbor summary 
1 port 'b' 14 mac 84:39:8F:90:95:41 chassis 84:39:8F:90:95:40 port 'b' system 'FGT-1'

In versions up to v7.0, the number of maximum neighbors that could be learned was set globally. Since v7.2, this limit has been set per-interface, and the maximum number of learnable neighbors is 4:

diagnose lldprx neighbor summary | grep "b"
5 port 'b' 14 mac 84:39:8F:90:95:41 chassis 84:39:8F:90:95:40 port 'b' system 'FGT-1'
6 port 'b' 14 mac 84:39:8F:EB:97:C7 chassis 84:39:8F:EB:97:C6 port 'b' system 'FGT-2'
7 port 'b' 14 mac 84:39:8F:EB:9F:33 chassis 84:39:8F:EB:9F:32 port 'b' system 'FGT-3'
8 port 'b' 14 mac 84:39:8F:EB:77:BF chassis 84:39:8F:EB:77:BE port 'b' system 'FGT-4'

The table includes only 4 entries per interface.

FortiOS behavior when the limit is exceeded:

If 4 lldp neighbors have already been detected and stored on an interface, and a LLDPDU from a further device is received, FortiOS overwrites the oldest entry with the new entry:

1311.966439 b -- LLDP 152 chassis 4 84:39:8f:eb:96:68 port 5 'b' ttl 120 system 'FGT-5' 
81F2 # diagnose lldprx neighbor summary | grep "b"
5 port 'b' 14 mac 84:39:8F:EB:96:69 chassis 84:39:8F:EB:96:68 port 'b' system 'FGT-5'
6 port 'b' 14 mac 84:39:8F:EB:97:C7 chassis 84:39:8F:EB:97:C6 port 'b' system 'FGT-2'
7 port 'b' 14 mac 84:39:8F:EB:9F:33 chassis 84:39:8F:EB:9F:32 port 'b' system 'FGT-3'
8 port 'b' 14 mac 84:39:8F:EB:77:BF chassis 84:39:8F:EB:77:BE port 'b' system 'FGT-4' 

When LLDP comes in, it is considered a new neighbor. The 5 port 'b' 14 MAC address 'FGT-5' above is a new entry.

This table change triggers the LLDP Fast Start, and multiple LLDPs packets are sent out from the interface (1 LLDP packet each 1-2 second, instead of one per 30 seconds).

Even if this could lead to temporary bursts of LLDP packets, it is important to note that it is generally not expected to have several LLDP neighbors on the same interface. Similar scenarios could be observed when a device along the network paths is explicitly configured to forward LLDP packets.

Related documents:

LLDP reception

Technical Tip: Use LLDP on FortiGate to verify connected switches