|
Topology:
FortiGate -> FortiSwitch1 <- Tier1 mclag-icl -> FortiSwitch2.
FortiSwitch can be any model starting from 2xx and above (FortiSwitches with 2xx models and above support mclag-icl)
FortiGate can be any model in standalone or HA mode.
To resolve the issue of a FortiSwitch losing connection after a FortiGate upgrade, follow these steps:
- Log in to the FortiGate and go to Switch Controller -> Managed Switches -> Topology and login to the FortiSwitch CLI by right-clicking on the FortiSwitch box.
- Check the STP priority of the FortiSwitch1 and Fortiswitch2 in the network.
FortiSwitch local CLI command:
diagnose stp instance list
- Identify the STP priority mismatch between the FortiSwitch1 and FortiSwitch2 by running the above command. In this case, the STP priority of the FortiSwitch1 is 16384, while the STP priority of FortiSwitch2 is 8192.
- Change the STP priority of the FortiSwitch1 to match the STP priority of the FortiSwitch2 for STP instances 0 and 15 by enabling local-override on FortiSwitch1 and applying a custom-command configuration on FortiSwitch1. In this case, change the STP priority of the FortiSwitch1 to 8192 to match FortiSwitch2 priority of 8192. This ensures that the both the mclag-icl Fortiswitches act as the Root Bridge in all STP instances including the default Instances 0 and 15. Make this change from the FortiGate switch-controller CLI.
FortiGate switch-controller CLI commands:
- Enable local-override on FortiSwitch1
config switch-controller managed-switch
edit <FortiSwitch1 SerialNumber>
config stp-setting
set local-override enable
end
end
- Create a custom command:
config switch-controller custom-command
edit "STP-Priority"
set command "config switch stp instance %0a edit 0 %0a set priority 8192 %0a next %0a edit 15 %0a set priority 8192 %0a end %0a"
next
end
- Configure custom-command on FortiSwitch 1:
config switch-controller managed-switch
edit <FortiSwitch1 SerialNumber>
config custom-command
edit 1
set command-name STP-Priority
end
end
next
end
- After changing the STP priority, run the 'diagnose stp instance list' command on both the FortiSwitches' local CLIs to ensure that both mclag-icl FortiSwitches (FortiSwitch1 and FortiSwitch2) are now showing the same Root priority and Root MAC-address.
- After changing the STP priority, run the 'diagnose switch mclag peer-consistency check' command on both the FortiSwitches' local CLIs to ensure that there are no issues with the 'FLINK_ICL0' trunk which is the mclag-icl trunk.
- Once the STP Root Bridge is same on both the switches and the mclag-icl peer-consistency check has passed, test the issue by performing an HA failover of the FortiGates or by performing an upgrade on the FortiGates.
|
