Technical Tip: Precaution for configuring transparent mode on Fortinet-VM appliances

[skobayashi_FTNT]

Description	This article explains a precaution when configuring Fortinet -VM appliances with a transparent mode (L2-bridge mode) on VMware ESXi.
Scope	Fortinet VM Appliances FortiGate-VM. FortiMail-VM. FortiWeb-VM. Transparent-mode enabled. VMware ESXi.
Solution	When deploying an OVF template of Fortinet VM appliance, all source networks of each interfaces(vNICs) will be mapped to one destination network/PortGroup by default, unless the destination network is manually mapped for each: If at least two vNICs are mapped to one network/PortGroup, and the operation mode of the VM guest OS is switched to transparent mode, an L2 loop will occur between the VM and vSwitch. Definitely, this loop can cause traffic storms, CPU spikes and network problems on ESXi/guest VM and other devices. Before switching the guest OS to transparent mode, one or both of these steps must be taken. Make all vNIC interfaces belong to different network (PortGroup and/or VLAN): Make all unused vNIC interfaces disconnected from vSwitch: If multiple VMs are running in transparent mode and they have the same mapping to PortGroup, it can cause an L2 loop. Example:           [VM-1]   (vNIC-1a)    (vNIC-1b)      |            | <PortGroupA>  <PortGroupB>      |            |   (vNIC-2a)    (vNIC-2b)           [VM-2]