FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Serxhio
Staff
Staff
Article Id 418572
Description

This article describes how to enable QSFP28 port splitting on FortiGate to create four 25G subports (e.g., port17.1 to port17.4) and use them in two separate LAGs (LAG1 to SW1, LAG2 to SW2) using QSFP28-to-4×SFP28 passive DAC breakout cables.

Scope

FortiGate 1800F/1801F, 4200F/4201F, 4400F/4401F  (with QSFP28 ports).

Solution

2 different LAGs can be built on the same QSFP port after being split (say port17.1 & 17.2 on LAG1 and port 17.3 & 17.4 on LAG2). These subports behave like regular physical interfaces and can be aggregated into separate LAGs without issues.

FortiGate QSFP28 breakouts are standards-based IEEE 802.3 and compatible with any vendor respecting the same standard.

 

FortiGate (QSFP28 port17) -> [QSFP28-to-4×SFP28 DAC].

                                               ├─ SFP28 #1 → SW1 (25G port A) → LAG1.

                                               ├─ SFP28 #2 → SW1 (25G port B) → LAG1.

                                               ├─ SFP28 #3 → SW2 (25G port C) → LAG2.

                                               └─ SFP28 #4 → SW2 (25G port D) → LAG2.

 

  1. Enable QSFP28 Port Splitting:

 

config system global

    set split-port port17

end

 

The system will reboot to make the setting take effect.

After the reboot: port17 → port17.1, port17.2, port17.3, port17.4 (all default 10G).

 

  1. Set Subport Speed to 25G (All 4 at once).

 

config system interface

    edit "port17.1"

        set speed 25000full

    next

end

 

Speed change applies to all four subports simultaneously. No reboot needed.

 

  1. Create LAG1 (port17.1 + 17.2 → SW1).

 

config system interface
    edit "LAG1"
       set vdom "root"
       set type aggregate
       set member "port17.1" "port17.2"
       set lacp-mode active
       set device-identification enable
       set lldp-transmission enable
       set role lan
       set allowaccess ping https ssh
       set ip 10.1.1.1 255.255.255.0
    next
end

 

  1. Create LAG2 (port17.3 + 17.4 → SW2).

 

config system interface
    edit "LAG2"
       set vdom "root"
       set type aggregate
       set member "port17.3" "port17.4"
       set lacp-mode active
       set device-identification enable
       set lldp-transmission enable
       set role lan
       set allowaccess ping https ssh
       set ip 10.2.2.1 255.255.255.0
    next
end

 

  1. Verification commands:

Check split status: get system interface physical.

Confirm 25G speed: diagnose hardware deviceinfo nic port17.1.

LAG status: diagnose netlink aggregate name LAG1.

Traffic stats: diagnose netlink interface list LAG1.

 

Related documents: