Skip to main content
Umesh
Umesh
Explorer II
December 16, 2022
Question

LACP configuration FGT and cisco switch

  • December 16, 2022
  • 4 replies
  • 8312 views

Hi All,

 

I have doubt regarding LACP configuration in fortigate Firewall along with cisco switch, Can anybody explain it how can we implement it real environment.

 

Please find the attached snapshot where you can see what I want to design in our environment.

 

Thank you.lacp.JPG

 

4 replies

ede_pfau
SuperUser
ede_pfau
SuperUser
December 16, 2022

I think the missing element in this setup is the ISL between SW1 and SW2. If both switches were stacked one would immediately see that both LACP trunks would be operating with 2 ports each.

 

If one switch fails, the trunk from the active FGT would halfe in bandwidth but continue to work. If you need the complete bandwidth at all times, monitor those links to trigger a HA failover if one link fails.

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    December 19, 2022

    Again: LACP trunks to 2 separate switches will not work. The solution is to stack these switches.

    Can you do this? Are there sufficient ports free for a link? Does your model and firmware support this?

    If not, you'd need to go with just one switch. Which, BTW, is not so uncommon, switches are much more resilient/reliable than devices with higher level functions like firewalls.

    gfleming
    Staff
    gfleming
    Staff
    December 16, 2022

    Yeah this won't work unless those two Cisco switches are either stacked together or using VPC. You can't establish a LAG split between two different independent switches.

     

    What model Cisco switches are they?

      Umesh
      UmeshAuthor
      Explorer II
      December 19, 2022

      Hi Graham,

      I would like to tell you that switch 1 and switch 2 are the normal L2 cisco switch, in this case can it work or not.

      Case 1 - If Sw 1 goes down, traffic should move via sw2

       

      jnielsen
      Staff
      jnielsen
      Staff
      December 19, 2022

      As Graham said, you can not make a LAG between two independent L2 switches. You must either stack them (e.g. Catalyst stack-ring) or make a VPC (Cisco Nexus). If you only have two stand-alone L2 switches, the best you could do would be something like this:

      Screenshot 2022-12-19 at 12.41.10.png
      This will give you some link redundancy and aggregation, but in case of e.g. the switch of the active firewall goes down/is rebooted, it will trigger a HA-failover. 

        Mohamed_Gaber
        Mohamed_Gaber
        Explorer III
        December 19, 2022

        You have to link the two switches to prevent loops in the network and have a path for the traffic that reaches one and needs to go through the other.

        If you configure LACP on FortiGate you have to consider a point. Don't put the ports of both FortiGate units in one LACP group on the switch. You should add them to two different groups. If you do the setup as your design, FortiGate will detect different switches on the ports, and one of the ports will work and the other will not. But we have two FortiGate. will they both choose the same switch or the master will do it? I am not sure. If the two units activate the link on different switches STP should disable one.

        Yurisk
        SuperUser
        Yurisk
        SuperUser
        December 20, 2022

        For completeness sake - yes, as others have said, you CANNOT create an aggregate trunk to 2 separate Cisco switches WITH LACP (you would get an error on FGT side "mismatch aggregate ID" of a sort and one aggregate would not form) . On the other hand, you can create an aggregate if you disable LACP altogether, and form the aggregate statically. I can't vouch how good will it be, or will it work as expected, but aggregate will come up.  I had to do it (unfortunately) in specific circumstances and it worked - Fortigate to 2 Cisco switches w/o LACP.

         

        If you feel adventurous, try doing LACP with debug enabled on FGT Fortigate LACP debug commands 

          Terms & ConditionsAccessibility statement