FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
srajapratap
Staff
Staff
Description

This article highlights an issue that occurs when FortiGate tries to manage multiple switches in a specific topology configuration.

Scope FortiGate and FortiSwitch.
Solution

The issue occurs in the following topology configuration:

- FortiLink interface type: 802.3ad aggregate

- FortiLink split interface: Enabled

- FortiLink neighbor detect: FortiLink

 

Topology-not working.png

 

CLI configuration:

 

# config system interface

edit fortilink

show full

set fortilink-split-interface enable

set fortilink-neighbor-detect fortilink

end

end

 

FortiSwitch1 is successfully discovered and shows as online on FortiGate after authorization. However, despite how FortiSwitch3 is still operational, the FortiGate is unable to recognize it: it shows as offline. Upon attempting to manually add it using its serial number in the FortiGate, the FortiSwitch still displays as offline.


After running # execute switch-controller get-conn-status <FSW_serial_number> on FortiGate, the following response is received:


No CAPWAP IP address retrieved for FortiSwitch S448ENTFxxxxxxxx

 

Since FortiSwitch1 and FortiSwitch3 are not physically connected, the Active FortiLink cannot discover the LLDP messages coming from FortiSwitch3 in the figure above. As a result, LLDP messages cannot be negotiated by FortiGate's 802.3ad aggregate interface with FortiSwitch3 and brought up for authorization on FortiGate.

 

Since the Standby FortiLink is administratively down and only utilized for redundancy, it will not handle any CAPWAP traffic and is therefore unsuitable for receiving LLDP traffic on the FortiGate.

 

To fix this, FortiSwitch units must be linked together in a ring-like or 'daisy-chain' topology using inter-switch links (ISL) or must be connected with an Ethernet cable. This physical topology change will resolve the issue. See the diagram below:

 

Topology.png

 

Referenced Documents:

https://docs.fortinet.com/document/fortiswitch/7.0.0/devices-managed-by-fortios/801204/single-fortig...

 

https://docs.fortinet.com/document/fortiswitch/7.0.0/devices-managed-by-fortios/173260/configuring-f...