Fortigate 60F and Cisco ACI BPDU issue

Hey Fortigeorge, 

I hope you're well. 

If this is the default 'internal' interface that is created from default, this is a virtual switch. Because you're connecting this to a device that has STP enabled for loop protection some changes to the FortiGate are required otherwise it will recognise this link as a blocked link such as in this case. 

You could disable STP entirely on the virtual-switch interface or at least disable forwarding of STP: 

config system interface
edit internal
set stp {enable | disable}
next

end

config system interface

edit internal

set stpforward {enable | disable}

set l2forward {enable | disable}

end

However, in your case I feel it would be better to use an individual L3 interface on the FortiGate rather than the virtual-switch. You can either remove one of the interfaces out of the default virtual-switch and connect this to a VLAN on the Cisco switch for connectivity with an IP address configured on the FortiGate interface to management. 

Or, if you aren't using the 'internal' interface, I would remove all references of that interface, delete the interface and you have all the ports available to use how you would like. As a part of my base builds, I delete the default virtual-switch as I do not use it in my builds. 

Try one of the above and let me know which one you use and if it works....it should!

Thanks, 

Dan.