FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
syadav
Staff
Staff
Article Id 327869
Description

This article describes a known issue with FortiGate 60xF (600F and 601F) models, where users are reporting that direct-attach copper (DAC) cables are not functioning on the ultra-low latency (ULL) ports when set for 25G speed.

Scope

FortiGate 60xF and FortiOS v7.2.6/7.4.1 or later.

Solution

The FortiGate 60xF models have 4 ultra-low latency ports (X5 to X8) which support both 10G and 25G speeds. By default, these ports are set to 10G SFP+ (10000full). For more information on the ULL ports (including changing their speed), refer to the following documentation: FortiGate 600F and 601F fast path architecture

 

While optical fiber is often used to interconnect devices at high speeds, direct-attach copper (DAC) cables or breakout DAC cables can also be used with these ultra-low latency ports at 25G speeds. DAC cables require the 'CR' media type to be set on these FortiGate ports to function correctly, but there is a known issue where the FortiGate-600F/601F models are missing this option:

 

Expected Output in v7.0 and up to v7.2.5/v7.4.1 (ull-port-mode 25G):

 

FortiGate-600F # config system interface

FortiGate-600F # edit x5

FortiGate-600F (x5) # set mediatype ?
sr Use Short Range transceiver
lr Use Long Range transceiver
cr Use Copper transceiver

 

Observed Output in FortiOS 7.2.6/7.4.2 and later (ull-port-mode 25G; note the missing 'cr' option).

 

[...]

FortiGate-600F (x5) # set mediatype ?
sr Use Short Range transceiver
lr Use Long Range transceiver

 

Note:

SR and LR media types should be used with fiber connections and direct-attached copper (DAC) cable should be used with CR media type.

 

In  v7.0.x, DAC cable or breakout DAC cable can function with SR media type when the ULL ports on the FortiGate 60xF models are set to 25G. However, compatibility issues can arise upon upgrading to FortiOS v7.2.6+ or v7.4.2+ which causes ULL ports with DAC cables to not function as expected. The recommendation is not to use SR/LR media types with a direct-attach copper cable as it may cause stability issues.

 

The CR media type feature for 25G speed has been resolved in v7.2.9, v7.4.5, and v7.6.0 for FortiGate-60xF.

 

The mediatype cr will be shown once speed has been defined as 25000auto.

 

FortiGate-600F (x5) # set mediatype
sr Use Short Range transceiver
lr Use Long Range transceiver

 

FortiGate-601F (x5) # set speed 25000auto

 

FortiGate-600F (x5) # set mediatype
cr Use Copper transceiver

 

FortiGate-600F (x5) # set mediatype cr

 

For reference, this is tracked under internal Engineering ticket #966384.

 

Workaround:

If the device is running on FortiOS versions prior to 7.2.9, 7.4.5, 7.6.0, it is recommended to set the ULL ports (x5 to x8) to 10G mode when using DAC cables for the FortiGate-60xF models. Alternatively, the non-ULL ports (x1-x4) can be used for 10G connectivity as well. To change the speed of the ULL ports, run the following commands in the CLI:

 

config system npu

    set ull-port-mode [ 10G | 25G ]

end

 

A warning will be presented after submitting the end command asking to confirm the change:

 

NP7 ULL port mode speed change will take effect after system reboot.
Do you want to continue? (y/n)

 

Important Note

The above command will automatically reboot the FortiGate several seconds after the warning is accepted, so it is strongly recommended to only execute the change during a scheduled maintenance window. The speeds will also be changed for the entire block of ULL ports (i.e. x5 to x8 will all be changed).