Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
os1001
New Contributor

Virtual Wire and LACP

Hello,

 

has anyone build a setup where you can transport LACP transparent over a FortiGate?

Our Setup is that the FortiGate will be installed between two Cisco devices which have configured LACP.

The FortiGate should just analyze the traffic and should be transparent for the Cisco's. This works so far except for LACP.

 

Here is an example of one Port:

config system interface edit "port4" set vdom "Monitor" set fail-detect enable set fail-alert-interfaces "port3" set broadcast-forward enable set l2forward enable set vlanforward enable set stpforward enable set type physical set alias "01-Edge" set snmp-index 8 next end

 

The Virtual Wires are configured with Wildcard VLANs.

This is the reason why we need to use the Virtual Wire. In the Transparent we needed to configure for every VLAN an interface if we wanted to analyze the traffic. This would have blow up the configuration.

 

Am I missing something?

I can see that on port4 the LACP message from the Cisco device is seen, but it will be not transported to port3 (which is the partner of the virtual wire).

 

Regards,

Oliver

2 REPLIES 2
qingyuau
New Contributor

Hi os1001,

 

Did you have the issue resolved?

 

I had a similar issue which both ends runs LACP, Fortigate virtual wire pair inline stopped the LACP establishement.

 

Thanks

 

George

mricardez
Staff
Staff

Hi,

 

The LACP PDUs are packets on L2, so in order to allow the forward of L2 on fortigate VWP, you can try enabling l2forward at interface level.

 

You also needs to consider forward arp packets.

 

config system interface
edit <interface_name>
set l2forward enable
end

config system interface
edit <interface_name>
set arpforward enable
end


https://docs.fortinet.com/document/fortigate/6.0.0/handbook/291690/layer-2-and-arp-traffic

 

 

Regards

TAC Enginner