Skip to main content
DamianE
Explorer II
November 18, 2023
Question

STP between Fortigate HarwareSwitch and Cisco SW2960X

  • November 18, 2023
  • 3 replies
  • 2732 views

I have a Fortigate100F (OS 7.0.13) with a Hardware Switch that have some interfaces, this hsw has the brige stp priority set to 12288 to act as root bridge.

 

- get sys stp switch-priority : 12288 hello-time : 2 forward-delay : 15 max-age : 20 max-hops : 20

 

-get sys stp list  bridge 'Internal_LAN' prio 12288 mac 04:D5:90:FB:02:9A vd 'root' root prio 12288 mac 04:D5:90:FB:02:9A cost 0 port 'port1' role designated state forward cost 20000 edge no rx 67 tx 129966 port 'port2' role designated state forward cost 20000 edge no rx 131637 tx 129974 port 'port3' role designated state forward cost 20000 edge no rx 131810 tx 129973 port 'port4' down

 

Here i can see that for the Fortigate perspective he is the root bridge 

 

The port1 its connected to a ABB switch that recognize the Fortigate as his root, but in port 2 and 3 has two cisco 2960x that ignore the priority of the Fortigate and one of they assume the bridge root role.

 

For one of Cisco (tha assumes as bridge root)

-show spanning-tree ...for exaple for one of some vlans VLAN0050   Spanning tree enabled protocol rstp   Root ID    Priority    32818              Address     2c73.a05c.8880              This bridge is the root              Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec    Bridge ID  Priority    32818  (priority 32768 sys-id-ext 50)              Address     2c73.a05c.8880              Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec              Aging Time  300 sec  Interface           Role Sts Cost      Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/1             Desg FWD 4         128.1    P2p Edge Gi1/0/3             Desg FWD 19        128.3    P2p Edge Gi1/0/23            Desg FWD 4         128.23   P2p Gi1/0/24            Desg FWD 4         128.24   P2p Gi1/0/25            Desg FWD 4         128.25   P2p  - show running-config .... spanning-tree mode rapid-pvst spanning-tree logging spanning-tree portfast edge bpduguard default spanning-tree extend system-id errdisable recovery cause udld errdisable recovery cause psecure-violation errdisable recovery interval 120 ..... interface GigabitEthernet1/0/23  description AR-FWC-1-P3  switchport trunk native vlan 999  switchport mode trunk  spanning-tree link-type point-to-point .....   

 

 and for the other Cisco

- show spanning-tree ..... VLAN0050   Spanning tree enabled protocol rstp   Root ID    Priority    32818              Address     2c73.a05c.8880              Cost        4              Port        46 (GigabitEthernet1/0/46)              Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec    Bridge ID  Priority    32818  (priority 32768 sys-id-ext 50)              Address     d0ec.35bc.9e00              Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec              Aging Time  300 sec  Interface           Role Sts Cost      Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/45            Altn BLK 4         128.45   P2p Gi1/0/46            Root FWD 4         128.46   P2p .... -show running-config ... spanning-tree mode rapid-pvst spanning-tree portfast edge bpduguard default spanning-tree extend system-id errdisable recovery cause udld errdisable recovery cause psecure-violation errdisable recovery interval 120 ... interface GigabitEthernet1/0/46  description AR-FWC-OT-ESJ-1-P2  switchport mode trunk  spanning-tree link-type point-to-point ....

 

I suppose thats somthing wrong with the cisco switches configuration. It could be the stp mode that is rapid-pvst???

 

3 replies

abarushka
Staff
Staff
November 19, 2023

Hello,

 

Is ABB switch configured to run RPVST or other standard of STP? 

DamianE
DamianEAuthor
Explorer II
November 19, 2023

The abb switch run rstp...I didn't find more detail in the manuals.

 

abarushka
Staff
Staff
November 20, 2023

Hello,

 

Is it feasible to switch the other 2 switches to RSTP / MSTP?

 

FortiSwitch supports RPVSTP, however it is not clear whether FortiGate supports it.

 

https://docs.fortinet.com/document/fortiswitch/7.2.5/administration-guide/364618/support-for-interoperation-with-rapid-per-vlan-rstp-rapid-pvst-or-rpvst (FortiSwitch)

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Spanning-Tree-Protocol-support-for-low-end/ta-p/192601 (FortiGate)

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!