Description | This article describes how to process if clients are not able to ping the gateway when Block Intra-Vlan traffic is enabled on the VLAN. |
Scope | FortiSwitch is Managed by FortiLink. |
Solution |
In some scenarios when Block Intra-Vlan traffic is enabled on the VLAN then clients fail to reach the gateway, but issue gets resolved once Block Intra-Vlan is disabled.
If topology consists of mclag-icl pair acting as core switches and is directly connected to FortiGate then to get Block Intra-Vlan work, mclag-icl switches should be root for the entire setup.
For example refer to the below diagram:
On Core-1:
MST Instance Information, primary-Channel: Instance ID 0 (CST) Root MAC e023ffd55540, Priority 20480, Path Cost 0, Remaining Hops 20 Regional Root MAC e023ffd55540, Priority 20480, Path Cost 0 Instance ID 15 TCN Events Triggered 10 (32d 13h 59m 18s ago), Received 77 (8d 15h 32m 16s ago)
On Core-2:
MST Instance Information, primary-Channel: Instance ID 0 (CST) Root MAC e023ffd55540, Priority 20480, Path Cost 0, Remaining Hops 20 Regional Root MAC e023ffd55540, Priority 20480, Path Cost 0
Instance ID 15 TCN Events Triggered 17 (8d 15h 40m 21s ago), Received 50 (8d 15h 39m 41s ago)
Refer to the below KB article to make the MCLAG-ICL FortiSwitches as root Bridge: Troubleshooting Tip: MCLAG-ICL interface in STP discarding state |