Technical Tip: Configure STP priority using 'custom-command 'on FortiGate
Description
This article describes how to configure STP priority on managed switches using custom commands.
Scope
For versions 3.x, 6.x, 7.x and 8.x.
Solution
From the FortiGate, executing a custom script on a managed FortiSwitch unit is possible.
The custom script contains generic FortiSwitch commands.
In the following example, a custom command is configured to change STP priority to 4096 on a managed FortiSwitch for default STP instance 0 and STP instance 15.
By default, a managed FortiSwitch is configured with MSTP (backward compatible with STP and RSTP) and consists of 2 MSTP instances: Instance 0 and Instance 15.
Instance 0 is for all VLANs and contains all ports/trunks i.e. data traffic.
Instance 15 is for VLAN 4094 and contains only FortiLink trunks i.e. only control plane traffic FortiLink/capwap.
The command is:
diagnose stp instance list
Example output:
MST Instance Information, primary-Channel:
Instance ID 0 (CST)
 Config        Priority 20480
                Bridge MAC 704ca5a19398, MD5 Digest 9999b43d77cc58bba8854f9991c4a487
 Root          MAC 704ca5a19398, Priority 20480, Path Cost 0, Remaining Hops 20         <----- This bridge is the root.
               Â
 Regional Root MAC 704ca5a19398, Priority 20480, Path Cost 0                            <----- This bridge is the regional root.
               Â
 Active Times  Forward Time 15, Max Age 20, Remaining Hops 20
 TCN Events    Triggered 5 (41d 16h 1m 52s ago), Received 6 (41d 16h 1m 32s ago)
 Port              Speed  Cost      Priority  Role        State       HelloTime Flags
 ________________  ______ _________ _________ ___________ __________  _________ _______________
 port1             -      200000000 128       DISABLED    DISCARDING  2         ED
 port3             -      200000000 128       DISABLED    DISCARDING  2         ED
 port4             -      200000000 128       DISABLED    DISCARDING  2         ED
 port5             -      200000000 128       DISABLED    DISCARDING  2         ED
 port6             -      200000000 128       DISABLED    DISCARDING  2         ED
 port7             -      200000000 128       DISABLED    DISCARDING  2         ED
 port8             -      200000000 128       DISABLED    DISCARDING  2         ED
 port9             -      200000000 128       DISABLED    DISCARDING  2         ED
 port10            -      200000000 128       DISABLED    DISCARDING  2         ED
 port11            -      200000000 128       DISABLED    DISCARDING  2         ED
 port12            -      200000000 128       DISABLED    DISCARDING  2         ED
 port13            -      200000000 128       DISABLED    DISCARDING  2         ED
 port14            -      200000000 128       DISABLED    DISCARDING  2         ED
 port15            -      200000000 128       DISABLED    DISCARDING  2         ED
 port16            -      200000000 128       DISABLED    DISCARDING  2         ED
 port17            -      200000000 128       DISABLED    DISCARDING  2         ED
 port18            -      200000000 128       DISABLED    DISCARDING  2         ED
 port19            -      200000000 128       DISABLED    DISCARDING  2         ED
 port20            -      200000000 128       DISABLED    DISCARDING  2         ED
 port21            -      200000000 128       DISABLED    DISCARDING  2         ED
 port22            -      200000000 128       DISABLED    DISCARDING  2         ED
 port24            -      200000000 128       DISABLED    DISCARDING  2         ED
 port26            -      200000000 128       DISABLED    DISCARDING  2         ED
 port27            -      200000000 128       DISABLED    DISCARDING  2         ED
 port28            -      200000000 128       DISABLED    DISCARDING  2         ED
 port29            -      200000000 128       DISABLED    DISCARDING  2         ED
 port30            -      200000000 128       DISABLED    DISCARDING  2         ED
 port31            -      200000000 128       DISABLED    DISCARDING  2         ED
 port32            -      200000000 128       DISABLED    DISCARDING  2         ED
 port33            -      200000000 128       DISABLED    DISCARDING  2         ED
 port34            -      200000000 128       DISABLED    DISCARDING  2         ED
 port35            -      200000000 128       DISABLED    DISCARDING  2         ED
 port36            -      200000000 128       DISABLED    DISCARDING  2         ED
 port37            -      200000000 128       DISABLED    DISCARDING  2         ED
 port38            -      200000000 128       DISABLED    DISCARDING  2         ED
 port39            -      200000000 128       DISABLED    DISCARDING  2         ED
 port40            -      200000000 128       DISABLED    DISCARDING  2         ED
 port41            -      200000000 128       DISABLED    DISCARDING  2         ED
 port42            -      200000000 128       DISABLED    DISCARDING  2         ED
 port43            -      200000000 128       DISABLED    DISCARDING  2         ED
 port44            -      200000000 128       DISABLED    DISCARDING  2         ED
 port45            -      200000000 128       DISABLED    DISCARDING  2         ED
 port46            -      200000000 128       DISABLED    DISCARDING  2         ED
 port47            -      200000000 128       DISABLED    DISCARDING  2         ED
 port49            -      200000000 128       DISABLED    DISCARDING  2         ED
 port50            -      200000000 128       DISABLED    DISCARDING  2         ED
 port51            -      200000000 128       DISABLED    DISCARDING  2         ED
 port52            -      200000000 128       DISABLED    DISCARDING  2         ED
 internal          1G     20000     128       DESIGNATED  FORWARDING  2         ED
 8EFTF18000001-0   1G     1         128       DESIGNATED  FORWARDING  2         EN ED
 8DF3X16002609-0   1G     1         128       DESIGNATED  FORWARDING  2         EN
 G200E4Q16900196   1G     20000     128       DESIGNATED  FORWARDING  2         ED
 test              -      200000000 128       DISABLED    DISCARDING  2         ED
 Flags: EN(STP enable), ED(Edge), LP(Loop Protection Triggered)
 RG(Root Guard Triggered), BG(BPDU Guard Triggered), IC(PVST Port Inconsistent)
 MV(PVST Port Vlan Mismatch)
Instance ID 15
 Config        Priority 20480, VLANs 4094
                Bridge MAC 704ca5a19398
 Regional Root MAC 704ca5a19398, Priority 20480, Path Cost 0                             <----- This bridge is the regional bridge.
               Â
 TCN Events    Triggered 5 (41d 16h 1m 53s ago), Received 3 (41d 16h 1m 32s ago)
 Port              Speed  Cost      Priority  Role        State       Flags
 ________________  ______ _________ _________ ___________ __________  _______________
 internal          1G     20000     128       DESIGNATED  FORWARDING  ED
 8EFTF18000001-0   1G     1         128       DESIGNATED  FORWARDING  EN ED
 8DF3X16002609-0   1G     1         128       DESIGNATED  FORWARDING  EN
 G200E4Q169001-6   1G     20000     128       DESIGNATED  FORWARDING  ED
 Flags: EN(STP enable), ED(Edge), LP(Loop Protection Triggered)
 RG(Root Guard Triggered), BG(BPDU Guard Triggered), IC(PVST Port Inconsistent)
 MV(PVST Port Vlan Mismatch)
Follow the below steps to change STP priority to 4096 on both instances 0 and 15 using the custom command:
Â
Use the following custom command on FortiGate:
config switch-controller custom-command
(custom-command) edit custom-stp
(stp) set command "config switch stp instance %0a edit 0 %0a set priority 4096 %0a next %0a edit 15 %0a set priority 4096 %0a end %0a"
(stp)end Push the commands to the FortiSwitches: (the serial number is the FortiSwitch(s) serial number).
config switch-controller managed-switch
(managed-switch) # edit "S248EFTF18-----5"
(S248EFTF18-----5) # config custom-command
(custom-command) edit "1"
new entry '1' added
(1) set command-name "custom-stp"
(1) end
Note: Starting with FortiSwitch version 8.0, administrators can control when custom commands are pushed to a specific managed FortiSwitch.
In earlier versions, custom commands configured for managed FortiSwitches were pushed only when the full configuration was updated. With FortiSwitch version 8.0, administrators can configure custom commands for a specific managed FortiSwitch to be pushed whenever a configuration change is made to that switch.
The custom commands are always pushed after the other configuration changes have been applied, ensuring that the custom commands are executed last.
To control when custom commands are pushed:
config switch-controller global
set switch-custom-cmd {on-replay | on-any}
end on-replay - Custom commands are pushed only when full configuration is updated and this is default option.
on-any - Cutsom commands are pushed after any configuration change on managed switch and custom commands are pushed last after other changes
It is also possible to execute a Custom Script once on a specific managed FortiSwitch using the following command, but since these changes are not bound to any switch, a FortiSwitch reboot may reset these parameters.
execute switch-controller custom-command <cmd-name> <target-switch>
For example:
execute switch-controller custom-command custom-stp "S248EFTF18-----5"On the FortiSwitch, make sure to disable auto-stp-priority.
On the FortiSwitch CLI:
config switch global
  set auto-stp-priority disable
end
Verify if the change is pushed to the FortiSwitch:
SSH into the FortiSwitch from FortiGate (execute ssh admin@<switchip>):
Switch# show full-configuration switch stp instance
Switch# diagnose stp instance list
Note: In the ‘set command’, %0a denotes a new line or return action.
Related documents:
FortiSwitch admin guide (stp instance/changing priority): Administration Guide—Standalone Mode
FortiSwitch managed guide (custom command): page 384 FortiLink Guide (FortiOS 8.0.0)
