Skip to main content
andersh
andersh
Visitor III
March 30, 2022
Solved

Change LACP settings on existing link

  • March 30, 2022
  • 4 replies
  • 24788 views

Hi,

 

I have changed our core switching to a pair of ArubaOS-CX devices and wanted to move the existing Fortigate LAG on X1/X2 on a 100F (6.0.14) to go to each of the Arubas.

The Aruba multi-chassis LAG can only be set up with LACP and it didn't come up so ended up creating a non-LACP LAG to just one of the switches to get us up and running. I have looked at the Fortigate and seen that the LACP type is static. My question is, can this be changed to active or passive on an already configured Fortigate LAG? Or like with everything else, do I have to remove all config and start again to create a new one?

I don't want to have to travel to the site to find out it can't be changed with a CLI command. Thanks!

Best answer by bpozdena_FTNT
@andersh wrote:

My question is, can this be changed to active or passive on an already configured Fortigate LAG?

Yes, you can of course change the LCAP mode on the fly.

 

If the mode is currently for some reason set to 'static' on your aggregate interface, it means that LCAP is disabled. It is therefore expected that the aggregate link would not come up when LACP was enabled on your Aruba switch.

 

You can enable LACP with the bellow command:

config system interface     edit <aggregate_port>         set lacp-mode active     next end

 

Just note that the moment you enable LACP in Fortigate, the link will go down and it will remain down until you also enable LACP (active or passive mode) on your Aruba switch. Once done, they should negotiate almost immediately. 

 

You can see the link status and LACP states with the bellow commands:

diag netlink aggregate list diag netlink aggregate name <aggregate_port>

 

NOTE: You should always schedule a maintenance window and have at least OOB access to your appliances if you cannot be physically on the sate. 

 

4 replies

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
March 30, 2022

By default lacp-mode should be active on any LAG like below. So you don't have remote access to the 100F? You should set up a VPN for secure remote admin.

 

xxx-fg1 (AggPath) # show full | grep lacp
set lacp-mode active
set lacp-ha-slave enable
set lacp-speed slow

 

xxx-fg1 (AggPath) # set lacp-mode ?
static       Use static aggregation, do not send and ignore any LACP messages.
passive   Passively use LACP to negotiate 802.3ad aggregation.
active      Actively use LACP to negotiate 802.3ad aggregation.

 

Toshi

andersh
andershAuthor
Visitor III
March 31, 2022

Thanks for the reply, I do have remote access, I was asking if you can set the LACP mode on a LAG which is already configured, set up and running with many references. If I attempt it now remotely, I will break it and lose access, or I could go to site, arrange downtime and find out I can't change the setting!

bpozdena_FTNT
Staff
bpozdena_FTNTAnswer
Staff
March 31, 2022
@andersh wrote:

My question is, can this be changed to active or passive on an already configured Fortigate LAG?

Yes, you can of course change the LCAP mode on the fly.

 

If the mode is currently for some reason set to 'static' on your aggregate interface, it means that LCAP is disabled. It is therefore expected that the aggregate link would not come up when LACP was enabled on your Aruba switch.

 

You can enable LACP with the bellow command:

config system interface     edit <aggregate_port>         set lacp-mode active     next end

 

Just note that the moment you enable LACP in Fortigate, the link will go down and it will remain down until you also enable LACP (active or passive mode) on your Aruba switch. Once done, they should negotiate almost immediately. 

 

You can see the link status and LACP states with the bellow commands:

diag netlink aggregate list diag netlink aggregate name <aggregate_port>

 

NOTE: You should always schedule a maintenance window and have at least OOB access to your appliances if you cannot be physically on the sate. 

 

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
March 31, 2022

If your remote access is coming through the link you change the config, I would never do the change remotely regardless if it's in maintenance window or not. Only in case I have another path to get in I would do that.

 

By the way, just in case your FGT is multi-vdom environment, the diag netlink aggregate commands @bpozdena_FTNT showed need to be run under one of vdoms, it doesn't matter which one but not under "global".

 

Toshi

    Terms & ConditionsAccessibility statement