Staff

Technical Tip: Precaution for configuring transparent mode on Fortinet-VM appliances

Description

This article explains a precaution when configuring Fortinet -VM appliances with a transparent mode (L2-bridge mode) on VMware ESXi.

Scope

Solution

When deploying an OVF template of Fortinet VM appliance, all source networks of each interfaces(vNICs) will be mapped to one destination network/PortGroup by default, unless the destination network is manually mapped for each:

If at least two vNICs are mapped to one network/PortGroup, and the operation mode of the VM guest OS is switched to transparent mode, an L2 loop will occur between the VM and vSwitch.

Definitely, this loop can cause traffic storms, CPU spikes and network problems on ESXi/guest VM and other devices.

Before switching the guest OS to transparent mode, one or both of these steps must be taken.

Make all vNIC interfaces belong to different network (PortGroup and/or VLAN):

Make all unused vNIC interfaces disconnected from vSwitch:

If multiple VMs are running in transparent mode and they have the same mapping to PortGroup, it can cause an L2 loop.

Example:

          [VM-1]
(vNIC-1a)    (vNIC-1b)
     |            |
<PortGroupA> <PortGroupB>
     |            |
(vNIC-2a)    (vNIC-2b)
          [VM-2]

Sign up