Skip to main content
jmart1191
jmart1191
Explorer
April 18, 2024
Question

Cisco Trunk port to Fortiswitch

  • April 18, 2024
  • 2 replies
  • 16175 views

I am trying to configure our core Cisco 9300 to pass vlan traffic to Standalone Fortiswitch FS-224E. I have a ticket opened with both Cisco and Fortinet and have had both engineers on the phone but we were not able to get it to work. Does anyone have this kind of setup that is working properly? Also, do I have to setup a different port to manage the fortiswitch? I have set a static ip to the internal interface but once I trunk the port on the cisco side i lose management and cannot ping the ip or get to the gui, I have cisco port 36 trunked and goes to directly to  fortiswitch port 1 (I've tried trunking and tried without trunking set allow vlans and nothing works), I set a static route. Not sure what I'm missing but support has been no help on the Forti side. Have verified the trunk works on the cisco with another cisco trunked and vlans and traffic do work,

 

This is my Cisco Interface

interface GigabitEthernet1/0/36
description uplink to Fortiswitch
switchport trunk allowed vlan 100,200
switchport mode trunk
switchport nonegotiate

 

I have test this trunk to another Cisco and the vlans do pass.

 

Fortiswitch I've configured port 1 2 ways,

 

edit port1

set allowed-vlans 1,100,200

 

and I've also configured a trunk and added port 1 neither work.

 

 

2 replies

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
April 18, 2024

It's a surprise either TAC can't figure out. Which one is your management vlan, 100 or 200?
And link lights are green on both sides, right? Means L1 is up.
Then show us below on the 224E:
- show switch physical-port port1
- show switch interface port1
- show system interface "management_interface_name"

224E should have a dedicated MGMT port with 192.168.1.99/24 by default. So either you need to use different subnet for your management interface or unconfigure the IP on "mgmt" interface.

Toshi

    jmart1191
    jmart1191Author
    Explorer
    April 18, 2024

    Hello, thanks for your reply, yes I'm having issues with TAC they are both basically pointing fingers and I'm having a hard time getting them both on the same call now. I do see the management port I don't have anything connected to it, do i have to run a second ethernet cable to that port in order to get to the gui? I actually configured everything on port 1, created the vlans to match the cisco vlans and added ports to the vlans in the forti. The ip I configured to internal, the mgmt port is still dhcp but it's not picking up a dhcp address.

     

    - show switch physical-port port1

    S224ENTF23006427 # show switch physical-port port1

    config switch physical-port

        edit "port1"

            set lldp-profile "default-auto-isl"

            set speed auto

        next

    end


    - show switch interface port1

    show switch interface port1

    entry is not found in table

    Command fail. Return code 1

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    April 19, 2024

    Wait a minute. Do you happened to be one of them who got confused by FSW's terminology "trunk", and configured it without knowing it's actually LAG/802.3ad?
    If so, you need to unconfigure the "trunk" on the 224E. It's not a VLAN trunk.

    Toshi

      pollardt3
      pollardt3
      New Member
      April 19, 2024

      I am just curious, what makes you buy fortiswitch instead of cisco? they are not cheap......(Or you are just using them to study NSE?)

      jmart1191
      jmart1191Author
      Explorer
      April 19, 2024

      I'm glad you ask lol, we are upgrading our firewalls to fortigate and from the demo's we've seen there's a lot of pros to having fortiswitches on our network in conjunction with fortimanager which we are also purchasing. I'm a cisco guy and I love cisco so I decided to purchase 2 of these fortiswitches to test and see how they play with our cisco equipment which we have at all of our sites. The price is also a pro for us, I purchased 2 cisco 9200's a couple of months ago and it came out to 6k+ with licensing and everything and with the fortigates I got 2 of them fully licensed for 1,500. If I can get them to work with our current setup that's awesome but if not I like cisco much better and it wouldn't matter to me.

        Toshi_Esumi
        SuperUser
        Toshi_Esumi
        SuperUser
        April 19, 2024

        I posted in another thread recentry but FMG won't manage standalone FSW's config. Only when it's "fortilink managed" FSWs can be managed by FMG.

        Toshi

          Terms & ConditionsAccessibility statement