How to Convert a Software Switch to Hardware Switch on HA Cluster

Question

Hello.

We have an Active/passive cluster setup with 200F devices that interface with a redundant LAN network. During the setup there were issues with loops occurring that were blocked by STP in the LAN network. The cluster LAN interfaces on the firewalls function as a transit LAN with VLAN sub-interfaces below it for our network hosts.

The network loops were mitigated by removing redundant links into the firewalls and the LAN network settings on the Ubiquiti switching equipment. We are not currently experiencing loop issues. But we are now trying to figure out how to fix the problematic setup to remove the STP loops and allow a redundant network.

The root cause of the loops looks like software switches on the FortiGate LAN interfaces. Per this link (https://community.fortinet.com/t5/FortiGate/Technical-Tip-Building-redundant-paths-to-switch-network-from/ta-p/279038), they are identified as not participating in STP. And the software switches are also not monitored if a LAN interface fails.

My question, what is the best strategy for removing a software switch with VLAN sub-interfaces and replacing it with a hardware switch on the firewalls? If I do it in the GUI, it looks like a complete breakdown and rebuild of the configuration of the firewall.

We appreciate any input or guidance,

Robert

Toshi_Esumi · Accepted Answer

"VLAN switch" vs. "Hardware switch" has almost nothing to do with "Software switch". If you're NOT using VLAN Switch specific feature, VLAN switch works in the same way hardware switch works. Disabling VLAN switch mode (to go back to the native hardware-switch mode) wouldn't help anything to get rid of software switch.

The software switch is configured under "config system switch-interface" in the config file. You should see the members under the interface name you configured.
To configure hardware switch (also VLAN switch), you need to configure "config system virtual-switch" instead like below.

config system virtual-switch
edit <interface_name_you_want>
set physical-swtich "sw0" <-- this depends on the model but likely sw0 would work
config port

edit "portX" <-- these are the member ports currently in the softswitch
next

edit "portY"
next
.....
end
next
end

Then you can remove the software switch config under "config system switch-interface" (and under "config system interface" if you want to change the name. but in that case you need to configure the new interface).

Toshi

AEK · Answer

Hi RobertI'd do as follows:Backup the configEdit the config file and change the SW switch to HW switchRestore the configDon't forget to keep the original backup, just in case there is an issue and you want to roll-back.Hope it helps.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded