FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
ncorreia
Staff
Staff
Article Id 230160
Description This article describes the case when FortiOS min-links command permits disabling a LAG interface when the number of available ports in the aggregation drops below a specified number.
Scope FortiOS.
Solution

After configuring a LAG, LACPDU frames are sent and received on each interface that is set to belong to the aggregate interface.

 

An example of a LACPDU frame between a FortiGate and a Cisco router:

 

LACPDU sent by the FortiGate:

 

ncorreia_0-1668690744351.png

 

LACPDU sent by the Cisco router:

 

ncorreia_1-1668690817492.png

 

When the number of available links drops below the value set in min-links, the FortiGate will disable the LAG interface and stop sending traffic through it.

 

Nevertheless, it will keep sending LACPDUs through the still available ports (if any) as before. There are no changes in the flags of these LACPDUs.

 

As a consequence, the remote LAG will not be disabled, since it is still receiving the LACPDUs from at least one active port and min-links is a local (non-standard) setting, and this will cause downtime.

 

Some of the other vendors implementing this feature chose to change some flags in the LACPDU when the minimum number of interfaces drops below the number set in min-links.

 

Here is an example of one of these implementations and what the changed flags are (more on the meaning below):

 

- Synchronization.

 

- Collecting.

 

- Distributing.

 

ncorreia_2-1668691472969.png

 

This set of flags will provoke the remote LAG interface to go down, making sure that the LAGs on both sides are down. This means that if a FortiGate is connected to a device implementing min-links in this way, its own LAG would be disabled.

 

This is not a bug but simply a difference in implementations, since min-links are not actually a standard, and the aforementioned changed flags are not related to the LAG interface itself but rather to the aggregated interfaces themselves individually. From the standard:

 

'The Synchronization flag indicates that the transmitting participant’s mux component is in sync with the system id and key information transmitted. This accommodates multiplexing hardware that takes time to set up or reconfigure. If set the flag communicate In Sync, if reset Out of Sync.

 

The Collecting flag indicates that the participant’s collector, i.e. the reception component of the mux, is definitely on. If set the flag communicates collecting.

 

The Distributing flag indicates that the participant’s distributor is not definitely off. If reset the flag indicates not distributing.'

 

To summarize, one should keep in mind that the FortiOS implementation of min-links will disable its own LAG interface but will not force the remote LAG to go down when the number of active interfaces drops below the number set minimum.

 

Related documents:

https://community.fortinet.com/t5/FortiGate/Technical-Note-Explanation-of-min-links-and-link-failure...

https://www.ieee802.org/3/ad/public/mar99/seaman_1_0399.pdf