Staff

Technical Tip: FortiLink over P2P wireless bridge/mesh

Forum|Forum|4 years ago
June 17, 2022
1 reply
204271 views

Description

This article describes how to bring a managed FortiSwitch over a P2P wireless bridge/mesh link.

Scope

FortiGate, FortiSwitch, and FortiAP version 7.x.

Solution

Refer to the following config example:

Setup:

FortiGate- FortiSwitch(Switch1)port7 - FortiAP433F <---Mesh link--->FortiAP433F- FortiSwitch(Switch2)port7.

Port7 has native VLAN1.

Configuration:

Both FortiSwitches must be in FortiLink mode:
Use the following FortiSwitch configuration:

Important: The command below (switch-mgmt-mode) is not applicable for FortiSwitch versions 7.2 and above. See the following document: Special notices 7.2.0.

config system global

set switch-mgmt-mode fortilink

end

config switch global

set fortilink-p2p-native-vlan 1

end

config switch-controller global

set ac-discovery-type auto

end

Here, VLAN1 is configured because APs are connected to native VLAN 1.

config switch physical-port

edit "port7"

set fortilink-p2p enable

end

Since the p2p native VLAN is configured as 1, the FortiLink VLAN 4094 will be tagged between the FortiSwitches. As a result, it is necessary to ensure that Leaf AP tags the VLAN 4094. Configure the following parameters on the Leaf AP:

cfg -a MESH_ETH_BRIDGE=1
cfg -a MESH_ETH_BRIDGE_VLANS=2,3,4094

cfg -c

Multiple VLANs can be added using a comma.

The output of the Inter-Switch Link (ISL) trunk FortiLink interface on both FortiSwitches is below. Note that the VLAN 4094 is tagged.

Switch1:

show switch trunk

edit "S124EFxxxx699-0"

set auto-isl 1

set static-isl enable --> Make sure to enable static-isl.
set members "port7"

edit "S124EFxxxx699-0"

set allowed-vlans 1,39,50,99,4088-4094
set dhcp-snooping trusted
set edge-port disabled
set snmp-index 33

Switch2:

show switch trunk

edit "S124EFxxxx159-0"

set auto-isl 1

set static-isl enable --> Make sure to enable static-isl.
set members "port7"

edit "S124EFxxxx159-0"

set allowed-vlans 1,39,50,99,4088-4094
set dhcp-snooping trusted
set edge-port disabled
set snmp-index 31

FortiGate:

execute switch-controller get-conn-status
Managed-devices in current vdom root:

FortiLink interface : FortiLnk-ha
SWITCH-ID VERSION STATUS FLAG ADDRESS JOIN-TIME NAME
S124EFxxxx159 v7.0.4 (071) Authorized/Up - 169.254.2.3 Fri Jun 17 04:54:27 2022 xxxx159_switch1
S124EFxxxx699 v7.0.3 (058) Authorized/Up - 169.254.2.4 Fri Jun 17 05:31:11 2022 xxx699_switch2

For FortiAP and FortiSwitch versions 7.2.x and above, make the following configuration changes:

Configure Static IPs on Mesh Leaf AP:

cfg -a ADDR_MODE=STATIC

cfg -a AP_IPADDR=x.x.x.x <-- This is the IP address of the leaf AP.

cfg -a AP_NETMASK=y.y.y.y <-- This is the subnet mask.

cfg -a IPGW=x.x.x.y <-- This is the default gateway.

cfg -c

Configure Static IP, static route, and NTP server IP on the Remote FortiSwitch, which is connected to Leaf AP:

config system interface

edit internal

set mode static

set ip x.x.x.x y.y.y.y <-- Where x.x.x.x is the IP address and y.y.y.y is the subnet mask.

end

config router static

edit 1

set status enable

set gateway x.x.x.x <-- Where x.x.x.x is the FortiLink interface IP address on the FortiGate.

set device internal

end

config system ntp

config ntpserver

edit 1

set server x.x.x.x <-- Where x.x.x.x is the FortiLink interface IP address on the FortiGate.

end

The auto-network VLAN on FortiSwitch should be 4094.

config switch auto-network

set mgmt-vlan 4094

set status enable

end

Note that without this last configuration, FortiLink will come up successfully, but users depending on DHCP assignment from FortiLink-associated VLANs will not work correctly.

Some network administrators might change the mgmt-vlan for a different value. This value can be checked on FortiGate as follows:

show system interface | grep "_default" -f

show full system interface <fortilink interface name> | grep mgmt-vlan

Related documents:

Page 43: FortiLink over a point-to-point layer-2 network: FortiSwitch Devices Managed by FortiOS 7.0

Refer to the following document link for the FortiAP mesh configuration: Setting up a mesh connection between FortiAP units

C

cybaron

New Member

I have spent hours and hours and hours working on fortilink over a P2P link. I have scratched my head so much as i've gotten it to work, then tried again and it does not work. For us we have two buildings and we have 2x ubitquiti Gigabeam LR pairs. To simplify, i'm just testing with one pair. Our setup is Fortigate 500E > 1024D MCLAG pair > 148F > Ubiquiti gigabeam > Ubiquiti giabeam > 148F. Fortigate running 7.0.14, all fortiswitches running 7.4.2. I have ALSO tested with a lab network of Fortigate 70F running 7.0.14 and 2x 148F running 7.4.2 with the p2p ubiquiti bridge between the 2x 148F.

Now everything I read is our ubiquiti p2p dishes just pass everything. there is no config, just a management vlan. A bunch of posts mentioning you need to set your fortilink p2p native vlan to match your ubiquiti management vlan. This did not help me.

I've read and done the config switch physical port. Edit port46 (or your port here). Set fortilink-p2p Enable command. Do this at both ends and I have in some cases seen the far end fortiswitch show to authorize. Like many I have authorized it but it never came back online. I have played around with changing the config switch global > Set fortilink-p2p-native vlan 123 (your choice here) at both ends and that has changed the behaviour sometimes.

Here is the BIG kicker, when I watch the process of the switches seeing each other, I see the interface come up with the switch of other side serial number and the trunk formed with the member port, however the fortigate cannot see it. This is what I did to fix it for me and replicated it 3x in both environments.

Config switch interface> edit internal > set native vlan 4094. (this gets done automatically when you physically plug in one fortiswitch to another fortiswitch - but not when doing it over a p2p bridge - atleast most of the time....?)

This one command paired with the config switch physical port > edit port46 (your uplink to p2p bridge) set fortilink p2p enable allowed me to manage my switch over the p2p link.

What is happening at least in my environment and firmware version is that the switches talk to each other, but the end switch is never managed by the fortigate as it never gets an ip address from the fortigate on the management vlan and on the switch management vlan it cannot communicate to the fortigate. Once the internal interface is set to native vlan of 4094, it can now communicate on the management vlan to the fortigate and that is it. I am presuming this is something to do with the P2P bridge and broadcast, or latency or just straight up bug in fortiworld. I have gotten it working without the internal vlan change, but I could not remember what i did or how and more importantly I could not replicate it.

in config switch interface you will see the other switch showing:

edit "8FFTF21xyzzzz-0"

set native-vlan 4094

set allowed-vlans 1-4094

This means the switches can see each other, but the fortigate cannot manage the far switch.

So to summarize,

I factory reset switches, rebooted my fortigate lab and connected 148F physically to fortigate, authorized it. Then cli config for that first switch and

Config switch physical port

Edit port46 (or port used)

Set fortilink-p2p enable

End

On switch at the other end of the p2p bridge with uplink unplugged.

Step 1:

Config switch physical port

Edit port46 (or port used)

Set fortilink-p2p enable

End

Step2:

config switch interface

edit internal

Set native-vlan 4094

end

Step3:

Connect the network cabled at both ends to the P2P bridge. I found it would come up to authorize really quick and more importantly stay connected. I've read some people say after authorized, that some settings change as the fortigate changes some config. Just check to make sure your internal interface it still set to native vlan 4094 after authorization.

I hope this helps many people.

Sign up

Login with SSO

Login to the community

Login with SSO