Technical Tip: FortiGate VM, FortiSwitch-MCLAG and ESXi Virtual Machine vMotion Application Note

DuyNguy · ‎05-13-2024

Description

This article describes and explains a FortiGate VM setup with Managed FortiSwitches in MCLAG and an ESXi Virtual Machine vMotion Application Configuration Note.

Scope

FortiGate VM and Managed FortiSwitches in MCLAG.

Solution

Issue Statement: When a virtual machine (VM) is moved to another ESXi host, a new FortiLink trunk is created and breaks its connectivity.

Topology:

VMWare ESXi Server Configuration:

Use either a Standard vSwitch or Distributed vSwtich.
Accept 'Promiscuous mode', 'MAC address changes', and 'Forged transmits' on the ports to the FortiSwitches (it is necessary to configure it globally).
The vSwitch must be configured to perform 802.3ad link aggregation in static mode and the load-balancing method must be set to 'Route based on IP hash'.
Network Failure Detection must be set to ‘Link status only’.
Teaming and failover for the NICs must both be configured to have the NICs active.

FortiGateVM Configuration:

Configure a FortiLink aggregated interface with two ports (port1 and port2).
Change the fortilink-neighbor-detection mode to 'lldp' (from FortiLink).

FortiSwitch Configuration

The MCLAG trunks of VMWare hosts must be created locally in each MCLAG switch since these are FortiLink trunks. Note: Creating MCLAG trunks in FortiGate switch-controller will not work.
With the switches already setup for MCLAG, create a new trunk, set MCLAG to Enabled, and set the Mode to Static.
Configure the trunks for LACP static and Port Selection Criteria/load balance algorithm 'src-dst-ip'.
Enable 'set static-isl' on these trunks and add the following commands on them:

set auto-isl 1 <- This means the system creates the ISL trunk.

set isl-fortilink 1 <- This refers to the FortiLink trunk, which is directly connected to FortiGate.

Example of a manually created trunk for Esxi Host1 on Core1:

config switch trunk

edit "EsxHost1"

set port-selection-criteria src-dst-ip

set description "Manually created trunk for EsxHost1"

set mode static

set bundle disable

set auto-isl 1

set fortilink 0

set isl-fortilink 1

set mclag enable

set static-isl disable

set static-isl-auto-vlan enable

set members "port4"

Example of a manually created trunk for Esxi Host1 on Core2: