Skip to main content
mrandrew
mrandrew
New Member
June 29, 2016
Solved

Fortigate 800C SFP+ Port

  • June 29, 2016
  • 2 replies
  • 20064 views

Will the FG-TRAN-GC (1000baseTX) SFP work in the SFP+ port of an 800C?  

 

I can do this with Cisco SFP+ ports.  They will take any 1Gig or 10Gig SFP.

 

You may be asking why.  Why use the SFP+ port when you have 4 other SFP 1Gig ports available.  I have 2 Fortigate 800C devices in HA.  One 800C is at the main site and the other is connected at the DR site.  HA runs over a 1Gig dedicated fiber.  The switch at the main site can utilize 10Gig, but the switch at the DR site does not have 10Gig ports.  

 

Thanks

    Best answer by ede_pfau

    I was running into a similar requirement lately. Customer was about to upgrade his 1 Gbps WAN link to 10 Gbps. To keep the configuration identical (that is, the port number before/after) I wanted to use an SFP plug now and an SFP+ plug later in the same 10GE-port. In contrast to the docs which simply state "SFP+ port will accept SFP transceiver as well", the link didn't come up.

     

    -> apparently there is no auto-negotiation if you use an SFP transceiver in an SFP+ port. If you pin it down to "1000full" it'll work. [Too late for me.]

    2 replies

    emnoc
    emnoc
    New Member
    June 29, 2016

    Yes that is doable and  it will work.

     

    Ken

     

    mrandrew
    mrandrewAuthor
    New Member
    July 1, 2016

    emnoc,

     

    Thanks for reply.  I forgot that these FG800Cs shipped with 2 1Gig fiber SFPs.  I placed one into port 24.  I was required to set the port to speed 1000full in order for it to link to the Cisco switch.  The bad thing now is that when I make this change on the port it makes the change on the other Fortigate.  I want one FG800 to run at 10GB and the other at 1GB.  Unless there is a way to manually set each firewall independent of HA, then I'm stuck finding another way or purchasing a 10GB option for the DR site.

     

    Thanks again,

     

    Andrew

    ede_pfau
    SuperUser
    ede_pfauAnswer
    SuperUser
    July 1, 2016

    I was running into a similar requirement lately. Customer was about to upgrade his 1 Gbps WAN link to 10 Gbps. To keep the configuration identical (that is, the port number before/after) I wanted to use an SFP plug now and an SFP+ plug later in the same 10GE-port. In contrast to the docs which simply state "SFP+ port will accept SFP transceiver as well", the link didn't come up.

     

    -> apparently there is no auto-negotiation if you use an SFP transceiver in an SFP+ port. If you pin it down to "1000full" it'll work. [Too late for me.]

    MikePruett
    MikePruett
    New Member
    July 21, 2016

    Ede,

     

    What kept you from just manually pinning it down on speed and duplex? Or did you not learn about that until after the project? Did something else come up that made you change your path?

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    July 21, 2016

    Well, onsite there was a little...pressure to proceed, and when the link didn't come up I just used another 1 GbE port. I wasn't thinking of the autonegotiation at that time, given that this is "just working" 100% of the time. I haven't even used a crossover cable in years now.

    mrandrew
    mrandrewAuthor
    New Member
    July 27, 2016

    All,

     

    I've successfully worked around the issue since I was required to manually set ports 23 and 24 at speed of 10000.  Auto negotiation was not going to work.   The best way to explain is with a diagram which I have attached.  

     

    So, to recap, we have 2 Fortigate 800Cs in HA.  One is located at a primary site, the other is located at a DR site.  The sites are connected by a dedicated 1Gbps fiber connection.  The 800C at the primary site is connected to a Cisco 4507 switch that is capable of 10Gbps.  The 800C at the DR site is connected to a switch that only has 1Gbps ports.  I configured ports 5,6,7,8,23, and 24 on the 800Cs in a LACP bundle.  On the main site 4507, I configured only the 2 ports that connect to 23 and 24 on the 800C in the bundle.  The ports on the 4507 that correspond to ports 5,6,7, and 8 are shut down.  On the DR site switch, I configured the ports on the 3560-X that correspond to ports 5,6,7, and 8 on the 800C in the bundle.  There are no connections from the 800C to the 3560-X on ports 23 or 24.  So, the LACP bundles come up just fine on both sides.  I have a 20Gbps bundle at the main site and a 4Gbps bundle at the DR site.

     

    Thanks all,

     

    Andrew

     

     

    Terms & ConditionsAccessibility statement