Skip to main content
Nubbins
Nubbins
New Member
February 23, 2025
Question

All VLAN sub-interfaces are seeing bandwidth usage of other interfaces.

  • February 23, 2025
  • 4 replies
  • 1842 views

Hi,

 

This one is a little hard to explain, but we and active/passive pair of Fortigate 120G's that have 802.3ad aggregate parent interfaces with multiple VLAN subinterfaces. 

 

The strange thing we are seeing is that when traffic passes over one of the VLAN subinterfaces, we're seeing roughly 10% of that bandwidth appear on the other interfaces.

 

For example, we have LAG1 with VLAN sub-interfaces of VLAN10, VLAN20, and VLAN30. All VLANs are idle, but if I run a speed test on a machine that sits on VLAN10, I'll see the VLAN10 bandwidth jump to 1000Mbps as expected, but the bandwidth graphs for VLAN20 and VLAN30 will each show between 50-100Mbps of traffic on them.

 

This is causing havoc with our monitoring and billing systems. Any idea why this is? We recently migrated the configurations from 60Fs and didn't have an issue with those.

We've tested with a completely new LAG and VLANs with a separate Arista switch stack and a single device in each VLAN. The devices in the VLAN are not seeing the traffic...

 

See below. 
(Edit: Image tags the wrong way round but you get the idea)

 

VLAN20VLAN20

VLAN10VLAN10

VLAN30.jpg

 

4 replies

Anthony_E
Staff
Anthony_E
Staff
February 25, 2025

Hello,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Best Regards
    Nubbins
    NubbinsAuthor
    New Member
    February 25, 2025

    Thanks Anthony.

     

    I've actually opened a ticket which has now been kicked around since Sunday simply trying to get the engineer to understand. I wish people would pick up the phone, it could have been clarified in 5 minutes.

     

    I've run a bunch of pcaps etc and have proved that there no actual traffic going over the sub-interfaces but for some reason all graphs on the dashboard and SNMP are showing the erroneous data.

    My gut feel is that there's something a miss on the 120Gs. 

     

      Anthony_E
      Staff
      Anthony_E
      Staff
      February 26, 2025

      Hi Nubbins,

       

      When you get the TAC solution, may I ask you to share it here for the other users?

       

      Regards,

      Best Regards
      FortiFairy
      FortiFairy
      New Member
      March 15, 2025

      Hi Nubbins,

       

      same here. 60F with 7.4.7 (no HA) no issues with bandwidth monitoring.

       

      But kinda same scenario with my 1100E HA pair.

       

      I am pushing data from one VLAN to another VLAN (802.3ad aggregate) and see the bits sent counted as received and on the other interface nothing.

       

      Via SNMP but also via Fortiview Bandwidth Monitor. Destination interface traffic is counted as outbound and the source interface traffic is near nothing. If you then have look at the "Fortiview Policies by Bytes" you see the correct data but on interface bandwidth monitor we see false data. 

       

      Please share your TAC answer, i am curious as hell.

       

      Regards

      josdriesen
      josdriesen
      New Member
      November 13, 2025

      Hi Nubbins

       

      Did you ever receive usable feedback and/or corrective actions which allowed you to solve this issue?

       

      I am doing exactly the same, using an 802.3AD aggregate and multiple vlan (sub) interfaces move traffic back / forward on this very same LACP.

       

      At first I thought I was going crazy. Having setup many clusters with aggregate interfaces using FG's I have never seen this behavior before. 

      Kind of  "comforting" to see you are having this issue with the exact same FG120Gs.

      I have tried all kinds of different settings on interface / lacp level .. no change. 

       

      Any input / feedback from you or Fortinet regarding this issues will be much appreciated

       

      kind regards

      Terms & ConditionsAccessibility statement