Skip to main content
dan
dan
Explorer II
March 13, 2021
Question

How to turn default hard-switch FortiLink to aggregate?

  • March 13, 2021
  • 1 reply
  • 9518 views

I have an FGT-61F (FortiOS 6.4.4) connected on Port A to a FortiSwitch ISL Ring (4 Units of 148F). So far all looks good.

 

The FGT-61F comes out of the box with two predefined dedicated as FortiLink interfaces (A,B).

I would like to setup a Standby Fortilink connection to another switch in the current ISL ring and wanted to use port B for that. Similar to the configuration described here: https://docs.fortinet.com/document/fortiswitch/6.4.2/devices-managed-by-fortios/617516/network-topologies#Single2 (Single FortiGate unit managing a stack of several FortiSwitch units).

 

However, A+B are setup as hardware switch. I can therefore not apply "set fortilink-split-interface enable" as Standby only works with aggregate interfaces. 

 

The out-of-the-box FortiLink interface represents like this:

config system interface
    edit "fortilink"
        set vdom "root"
        set fortilink enable
        set ip 169.254.1.1 255.255.255.0
        set allowaccess ping fabric
        set type hard-switch
        set snmp-index 7
        set auto-auth-extension-device enable
        set switch-controller-nac "fortilink"
        set swc-first-create 127
    next
end

 

Since the current FortiLink interface has many dependencies and I'd like to stay as much as possible with the pre-configured setting, it is not a simple task (at least for me) to change this interface into an aggregate interface which would then allow to enable split-interface. 

 

Is there a way to change that current fortilink interface in a way that I can connect port B to another switch and get a standby connection? Would you be able to show me step by step on how to do this? I would really appreciate your help.

 

I might want, to a later time, turn the main connection into an MCLAG, but for the time being I'm just interested in a Standby FortiLink as shown in the picture.

 

Thanks for any hint.

 

Daniel

 

 

 

Information sources consulted so far:

[ul]
  • FortiSwitch Managed by FortiOS 6.4
  • https://docs.fortinet.com/document/fortiswitch/6.4.2/devices-managed-by-fortios/617516/network-topologies#Single2
  • For later: https://docs.fortinet.com/document/fortiswitch/6.4.5/devices-managed-by-fortios/801208/transitioning-from-a-fortilink-split-interface-to-a-fortilink-mclag
  • https://www.youtube.com/watch?v=pCm1Z1iUops (and a lot more youtube videos, not showing what I'd need...)[/ul]

    • 1 reply

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    March 13, 2021

    Just get in CLI, then "show | grep -f fortilink" so you can see all references you need to remove before removing the fortilink hard-switch. That's how I did to separate "a" port on FG40F. I don't remember exactly but DHCP server, and NTP server (needed to disable ntpsync) etc. config was using it.

    dan
    danAuthor
    Explorer II
    March 14, 2021

    Hello Toshi,

    I had to delete the VLANS and the already authenticated FortiSwitches as well. 

    But the VLAN's were recreated and the switches did come back too.

    Unfortunately I only realized later that the 148 Switches I use do not support MCLAG. What a shame...

     

    Anyway, the Standby FortiLink is working now. Fortigate port A is connected to one switch (Active) and Fortigate port B is connected to another switch (standby). I physically disconnected A and checked that B became active.

     

    One thing puzzles me a bit. Shortly after the change from A to B, I will see both connections from the FortiGate to the two switches as dotted lines in the FortiLink topology view. After a while, one line gets solid, as expected.

     

    But after yet another few minutes, the dotted line (the standby link) just disappears. I would have expected that the standby connection would stay visible as dotted line.

     

    I can also not see that (lost) cable connection in the ports view. Although the cable still is connected, both ends are inactive. For the ports view in the Fortigate, those two ports are just inactive as if there was no cable connection. 

     

    The logfile on the switch reports 

    FortiLink: disabled port port44 port-id=44 from b(1) fwd(1)

    FortiLink: removed port port44 port-id=44

     

    Is that a bug of the GUI?

     

    Daniel

     

    mowen
    mowen
    New Member
    March 19, 2021

    You can also take a backup of the current FortiGate, then in under sys interface change type to Agg.  

    Old config

          config sys inter 

          ....

          edit fortilink

          ...

          set type hard-switch

          ...

          next

          end

    Change the "hard-switch" to "aggregate" and leave the Members alone.  Then upload the new config to the firewall, it reboots and now you have an aggregate.  I have used this to move a Fortilink connection from a single link to an Aggregate in the past.   Mike 

     

     

      Terms & ConditionsAccessibility statement