Fortiswitch MCLAG 1024E daemon l2dbg killed messages

Hello sj3fk3, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Hello again sj3fk3,

I found this answer. Can you tell us if it helps, please?

You are experiencing traffic loss during failover to the passive FortiGate in an HA pair, specifically on VLANs where intra-VLAN blocking is enabled. The issue seems to be related to MAC address learning on the wrong trunks, which causes a delay in traffic recovery.

Observations from Logs

1. Daemon Logs: The logs indicate that the l2dbg daemon is frequently starting and stopping. This could be indicative of an issue with the Layer 2 debugging process, which might be affecting MAC address learning and VLAN operations.

2. Crash Logs: The crash logs show multiple instances of the l2dbg daemon being killed. This is not typical behavior and suggests that there might be an underlying issue with the daemon that could be contributing to the failover problem.

Potential Causes

• Intra-VLAN Blocking: The feature might be interfering with the normal MAC address learning process during failover, causing the MAC addresses to be learned on incorrect trunks.

• Daemon Instability: The instability of the l2dbg daemon could be affecting the switch's ability to correctly manage Layer 2 processes, including MAC address learning and VLAN management.

Recommendations

1. Review Intra-VLAN Blocking Configuration: Double-check the configuration of intra-VLAN blocking to ensure it is set up correctly and not causing unintended side effects during failover.

2. Investigate Daemon Stability: Look into the reasons for the frequent restarts of the l2dbg daemon. This might involve checking for known issues in the current firmware version or consulting Fortinet support for further diagnostics.

3. Firmware Updates: Ensure that both the FortiGate and FortiSwitch firmware are up to date. Sometimes, upgrading to the latest firmware can resolve known bugs and improve system stability.

4. Consult Fortinet Support: Given the complexity of the issue and the potential for it to be a bug, it might be beneficial to open a support ticket with Fortinet for a more in-depth analysis.

Follow-Up

• Logs and Diagnostics: When you have access to the corresponding logs and events, review them for any additional clues or patterns that might help in diagnosing the issue.

• Testing: Consider testing the failover process in a controlled environment to replicate the issue and gather more data.

If you need further assistance or have additional information to provide, feel free to reach out.

Hi sj3fk3,

Can you find a solution for this problem ?

Regards

Hi,

I might be mistaken but set aside from the crashlog

If you failover it takes time and it's learning from the wrong trunks, on some high ends switches it takes time for them to clear their mac addresses  you might need to simulate a link failure

can you maybe try and run

config system ha

set link-failed-signal enable

end