Skip to main content
fortimaster
Explorer III
Nov 13, 2024 4:49 PM UTC
Question

Software switch witouth loop in fortigate?

Hi all, 

I have 2 switches connected to 2 fortigate interfaces that forms a software switch. This software switch routes some Vlans that terminates at these ports. Both ports share layer 2 and 3 parameters. When traffic from different vlans reaches firewalls, I route traffic between then with rules.

I won't go into the details of this design, but the switches are in different locations and need to share networks/vlans.

 

With software switch, servers from both switches can directly reach the gateway with direct connections to the firewall. In some cases, I move virtual servers between locations (using a dedicated Fiber cable) and with this topology servers works with same network configuration in both sites.

 

I would like to connect a new cable between switch 1 and switch 2 to bypass traffic between same vlans but, if I do that, I'll form a layer 2 loop. (Red line diagram). What I would like if it's possible is:

1)Use 2 different ports in firewall to can route same networks/vlans (north south).

2)Add a new connection to bypass east-west traffic between same vlans (witouth routing). I don't want in any case to use spanning tree.

 

Is there any way to do that? Changing the software switch to another type of configuration would not be a problem.topology.JPG

 

I attach a symple diagram so you can better understand the topology. I know this is probably not possible, but I prefer to confirm with you. I can't form a LAG cause switches doesn't forms an MCLAG or stack and is not possible to form it with them.

 

 

 

 

 

 

6 replies

Stephen_G
Staff & Editor
Staff & Editor
Nov 17, 2024 5:27 PM UTC

Hello,

 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

 

Thanks,

Translate
Stephen_G - Fortinet Community Team
Stephen_G
Staff & Editor
Staff & Editor
Nov 19, 2024 7:27 PM UTC

Hello fortimaster,

 

We are still looking for someone to help you.

We will come back to you ASAP.


Regards,

Translate
Stephen_G - Fortinet Community Team
Gab_FTNT
Staff & Editor
Staff & Editor
Nov 21, 2024 3:03 PM UTC

Hello FortiMaster,

Adding the wire between Switch1 and switch2 will without any doubt create a loop in the network.
It is simply not possible from my understanding, there's no avoiding this without unplugging a port, using STP or keeping a port down.

Regards,
Gabriel

Translate
fortimaster
Explorer III
Nov 21, 2024 3:47 PM UTC

That's what I thought. Thanks for your help.

Translate
ebilcari
Staff
Staff
Nov 21, 2024 4:24 PM UTC

STP is also not supported for Software switch. This is not the right way to configure this setup but you can try by blocking Intra-switch traffic in the software switch configuration (I haven't tested and don't know the exact behavior).

Translate
Emirjon
fortimaster
Explorer III
Nov 21, 2024 4:34 PM UTC

That's just that I want... I will look into it.

Translate
Risk and Resilience in the Age of AI. An OT Thought Leadership Summit for Houston's Critical Infrastructure Leaders. Date: Thursday, December 3, 2026. Time: 8:30 am - 1:30 pm (CT). Location: The Westin Houston, Memorial City | 945 Gessner Road, Houston, TX 77024