Skip to main content
AGMP
AGMP
Explorer
February 8, 2023
Solved

standalone Fortiswitches configure LAG/LACP

  • February 8, 2023
  • 5 replies
  • 8169 views

Hey everyone,

I have two fortiswitch 224D running 7.2.2 firmware that i want to configure standalone.
Switch 1 uses ports 23/24 for WAN and is connected to switch 2 with fiber.
My workstation is connected to switch 1 using mgmt port.

I created the vlans i need and also created a trunk using the fiber ports however, i seem not to be able to communicate with switch 2.

Since i am obviously doing something wrong but don't know what, could someone point me in the right direction ?

Best answer by ebilcari

You have to configure a valid GW on the static route configurations on the switch being part of this subnet 172.16.0.x. The gateway device should be able to route the traffic from the switch to the PC you are using to access it.

5 replies

ebilcari
Staff
ebilcari
Staff
February 8, 2023

As I understood you have connected the two switches with two fiber links and you are trying to setup a Link Aggregation on those 2 links. Did you pass the needed VLAN on the trunk interface?

https://docs.fortinet.com/document/fortiswitch/7.2.2/administration-guide/352388/link-aggregation-groups

You can try to setup two IPs on both Switches on the same subnet and VLAN, make sure it's allowed on the trunk and try to ping from one switch to another.

Emirjon
AGMP
AGMPAuthor
Explorer
February 13, 2023

Thank you for your reply. You are correct, that is what i am trying.
I want to connect switch one to my router and connect switch 2 to switch 1 using fiber.
I have 3 VLANS and assigned an ip address to VLAN1 (on both switches. last octed .240 and .241) and can ping .241 from .240

 

gfleming
Staff
gfleming
Staff
February 13, 2023

What connectivity between switches is not working? You should have L2 connectivity across the trunk. That is endpoints on SW2 in VLANX should be able to communicate to endpoints on SW1 in VLANX.

 

Are you struggling to communicate with SW2's L3 management IP address?

    AGMP
    AGMPAuthor
    Explorer
    March 17, 2023

    Due to illness i was unable to reply.
    The situation is now like this:

    Switch 2:
    - Connected to the network on port 24 (uplink)
    - Endpoint device on port 1 (dhcp)
    - Fiber on port 28 to switch 3

    Switch 3:
    - Fiber to Switch 2 on port 28
    - Endpoint on port 1 (dhcp)

    On both switches port 28 is added to a trunk
    Both switches have the same VLAN setup on the same ports (1,10,18 where 10 is native)
    VLAN 1 has a static ip address:

    Traffic is forwarded from switch 2 to switch 3 and also returning. So Endpoint devices have internet and network access.


    I can connect to both switches now through the network when i set my network adapter to the same subnet as VLAN1, else not.

    I do have configured a static route on both switches to the gateway

    At this point i am not sure what the problem could be. As far i i understand it, i should be perfectly able to connect to the switch from any VLAN. Not only the MGMT port or when using the same subnet ?


    ebilcari
    Staff
    ebilcari
    Staff
    March 17, 2023

    I was doing some tests and found out that on the route the Device should be set as Internal

    internal.PNG

    You can also check if the route is being applied by running this command

    # get router info routing-table all
    Codes: K - kernel route, C - connected, S - static, R - RIP,
    O - OSPF, I - IS-IS, B - BGP, P - PIM, A - Babel,
    > - selected route, * - FIB route, ^ - HW install failed

    S>* 0.0.0.0/0 [10/0] via 10.5.32.1, internal
    C>* 10.5.32.0/23 is directly connected, internal
    C>* 127.0.0.0/8 is directly connected, lo

    https://docs.fortinet.com/document/fortiswitch/7.2.3/administration-guide/095393/remote-access-to-the-management-port

    Emirjon
    ebilcari
    Staff
    ebilcari
    Staff
    March 17, 2023

    A simple ping from the GW to the switch management VLAN verifies that the mgmt VLAN spanning is done between the switches and the GW, than is a matter of routing and security policies. If you have used the VLAN1 just make sure that the Gateway is routing this traffic and the static route configured in the switches are correct.

     

    If you want to create a dedicated management interface tied to a VLAN you have to create an internal interface and setup the IP. (default is on VLAN 1). 

     

    mgmt.PNG

     

    Emirjon
    AGMP
    AGMPAuthor
    Explorer
    March 17, 2023

    This is what my configuration of Switch 3 looks like. Gateway is 172.16.0.240 which is switch 2

     

    1.png2.png3.png4.png

    ebilcari
    Staff
    ebilcari
    Staff
    March 17, 2023

    You have to span VLAN 1 (mgmt) to the L3 device you have in the network and set the IP of that L3 devices (router/firewall/L3switch) as gateway on both of this switches.


    In your current configuration you are adding switch 2 as the next hop and I don't think that switch 2 is routing these packets anywhere.

    Emirjon
      AGMP
      AGMPAuthor
      Explorer
      March 27, 2023

      Sorry for the late reaction.

      I have made some changes as you suggested and it is pretty much working. Only thing is that i still can not connect to the management vlan from a different vlan.

      So what i want to achieve is this:

      I do have a management VLAN (VLAN1) that is used to manage servers and network devices.
      Admins are allowed to use that VLAN and access the webinterface. Users are not allowed to use that vlan or  connect to the webinterface of the switch.

      I (as an admin) want to be able to connect to the switch using VLAN3 from whatever VLAN i am on.
      That is how it works on the current unify gear. 

      At this point i can only connect to the fortiswitch web interface when i use a local IP of 172.16.0.x

      So at this point i am not sure where to add what to achieve what i want.

      ebilcari
      Staff
      ebilcariAnswer
      Staff
      April 19, 2023

      You have to configure a valid GW on the static route configurations on the switch being part of this subnet 172.16.0.x. The gateway device should be able to route the traffic from the switch to the PC you are using to access it.

      Emirjon
        AGMP
        AGMPAuthor
        Explorer
        April 24, 2023

        I was able to fix it by configuring the gateway. Traffic is now going correctly trough both switches.
        However, i am not able to connect to the webbased dashboard on the ip address i configured for the VLAN. I can only connect using the MGMT port. 

        I did enable Ping, HTTPS and SSL but it still won't work. Also changed my computers LAN IP to the VLAN subnet but without succes. Is there anything else i could try ?

        ebilcari
        Staff
        ebilcari
        Staff
        April 24, 2023

        The management port IP is treated as out of band management and as I know will not be routed or switched using the traffic ports.

        In order to achieve inbound management you have to configure in Router> Config> Interface [internal], set up an IP and Access protocols. You also need to set a default static route selecting "internal" as Device (Destinationn 0.0.0.0 0.0.0.0) and the Gateway.

        Emirjon
        AGMP
        AGMPAuthor
        Explorer
        April 25, 2023

        Thank you for your reply.
        I did make the suggested changes. But that did not work. So i probably made a mistake.

        In the original setup i am able to ping the second switch which is connected via a trunk.
        After i made the changes, i am not able to connect to the dashboard or ping the second switch.

        Terms & ConditionsAccessibility statement