Why does Fortigate require me to make LACP configurations separate networks?

Forum|Forum|3 years ago
April 21, 2023
3 replies
8974 views

Hi! First post.

I recently got into a Fortigate 40f and then quickly upgraded to a 60f (not a waste; I have another use coming up for the 40f). I have the Fortigate connected to multiple WANs (in SD-WAN), PC, TV/chromecast and a WAP. I'm also connected to a distant home office where I plan to have a cisco stack of two switches with some other PC/Server devices, TV/chromecast, another WAP and some IoT (wireless bulbs and cameras). I plan to LACP the cisco stack back to the Fortigate. I want everything on the same network and, in the future, I plan to move the WAPs and IoT off to a separate vlan.

My question is this: Why must I make the LACP connection to my cisco stack a separate network on the fortigate? This is essentially just etherchannelling "two" switches together - the Fortigate hardware switch and the cisco stack. Is there a way to have all Fortigate LAN and Fortilink ports on the same hardware switch and still use LACP to connect my cisco stack such that everything is on the same LAN segment?

Thanks!

FortiGate

Toshi_Esumi

SuperUser

Fortilink is for like FortiSwitches(FSWs) connected over CAPWAP. If you don't have FortiSwitches, you don't have to use Fortilink. You can "de-configure" fortilink A, B port to be independent ports.
Then you can configure LAG/LACP interface on your 60F, or even 40F.

Toshi

khuffmanjrAuthor

New Member

Right, I get that. But when I create an LACP Interface, I must put it on a separate network (IP). I don't want to. I want it to work like many other switches where I can just etherchannel them together and have one larger network that includes the Fortigate switch ports.

Thanks. Any other thoughts, please?

Toshi_Esumi

SuperUser

Why do you think you have to? I never did that before, or I thought it's not possible. Can you show us GUI or CLI what you're seeing?

Toshi

Toshi_Esumi

SuperUser

Are you talking about the "Create address object matching subnet"? That's only for an address object you can use it later in FW policies or some other places. If you don't plan to use it, you can just disable it. You can create an address object later if/when you need it.

Toshi

Toshi_Esumi

SuperUser

Or, LAG/LACP interface is a logical interface. You have to define an IP on it just like Cisco's "Port-channel".

Toshi_Esumi

SuperUser

You can't have hard-switch/vlan-switch interfaces as a part of LAG/LACP members. You have to remove those ports from the hard-switch/vlan-switch interfaces, like "internal" (60F), or "lan" (40F).

Toshi

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded