Description
This article describes that it is very common to configure LACP to increase a bandwidth and having a failover capability. LACP basically combining multiple port and works as 1 physical cable.
However, due to certain scenario, the LACP can not work as per expectation.
Scope
FortiGate.
Solution
The issue that can happen is as follows:
- Flapping is happening (port up and down).
- Network intermittence: Even a ping to the FortiGate interface is not working.
- Firewall keeps failing over.
LACP group is considered as 1 physical cable. Means only intended to connect to the same unit/brain only.
This can be defined as follows:
- Physical unit.
- Physical units act as 1 brain. Known as a stack. Normally configured on the switch.
Scenario 1.
On switch.
- Port1 and port2 configured as LACP group 1.
- Port1 and port2 connect to PC-Syarif. IP address 192.168.1.254.
This makes connectivity for PC-Syarif is 2GB.
Scenario 2.
On switch.
- Port1 and port2 configured as LACP group 1.
- Port1 connects to PC-Syarif. IP address 192.168.1.254.
- Port2 connects to PC-Jackie. IP address 192.168.1.253.
Refer to diagram below:
It is not possible for 1 'cable' to connect to 2 PC at the same time.
PC-Syarif and PC-Jackie have individual brains.
Not the same brain. STP can take action in this kind of scenario.
Either port1 will be shut down or port2 will be shut down.
This is to mitigate ARP conflict, broadcast issues, and so on.
The action is done on the switch level.
Both PC-Syarif and PC-Jackie only notice that their traffic will not be flowing, or notice that the physical cable on the adapter is not connected.
Now, let's replace:
PC-Syarif as FortigateA.
PC-Jackie as FortigateB.
Now, let's replace:
PC-Syarif as FortigateA.
PC-Jackie as FortigateB.
Even if the FortiGate is on HA mode(active-passive or active-active), each FortiGate is still considered as a 2 individual brains.
When HA is broken, the common term 'split brain' issue can happen.
Both individual brains having the same information and network(switch) will start to take action to mitigate this using STP and other measurements.
To mitigate this issue, proper design has to be executed on the network level.
1 LACP group only intends to connect to 1 unit or a stacked unit that acts as 1 brain.
1 LACP group only intends to connect to 1 unit or a stacked unit that acts as 1 brain.
Related articles:
Technical Tip: High availability basic deployment design
Technical Tip: Initial troubleshooting steps for LACP (Link Aggregation - 802.3ad)
