Advantages/Disadvantages of deploying Fortilink as hardware switch vs aggregate?

[LBC_Solutions_Arch]

I'm working in an environment where some sites have Fortilink set as an aggregate, and some as a hardware switch.  Are there any benefits to standardizing on one design over the other, aside from consistency across the org?

[spoojary]

Standardizing on one network design, whether using FortiLink as an aggregate or hardware switch, offers several benefits:

1. Simplicity: Easier management and troubleshooting.
2. Efficiency: Streamlined support, training, and upgrades.
3. Integration: Improved compatibility with other tools.
4. Performance: Better optimization and reliability.
5. Vendor Support: Enhanced assistance and documentation.
6. Security: Consistent policies across the network.
7. Predictability: Baseline metrics for monitoring.
8. Change Management: Simplified updates with fewer disruptions.
9. Cost Savings: Reduced training, support, and hardware expenses.

[chauhans]

Hello @LBC_Solutions_Arch 
The main difference between Fortilink as a hardware switch and as an aggregate is how traffic is forwarded.

In a hardware switch, traffic is forwarded directly between the ports on the FortiGate, without involving the CPU. This can provide better performance, especially for high-bandwidth traffic. However, a hardware switch can only be used with FortiGates that have integrated switches.

In an aggregate, traffic is forwarded between the ports on the FortiGate by the CPU. This can provide less performance than a hardware switch, but it can be used with any FortiGate.

Also,  A hardware switch can only have a limited number of ports, while an aggregate can have as many ports as you need.

Thanks,
Shaleni

[Adolfo_Z_H]

sorry to correct you Shaleni, information you provided is quite old and is not longer correct.  Fortigate "hardware switch" is not a complete hardware switch, there still is some FGT process involved in it. So as per latest best practices  from FOS 6.4.5 and onwards is not longer recomended.

https://docs.fortinet.com/document/fortiswitch/6.4.5/devices-managed-by-fortios/801202/single-fortig...

for small deployments and/or light traffic like small branch office, can be used as alternative for high avaliability to use with entry level FGT/FSW models

https://docs.fortinet.com/document/fortiswitch/6.4.5/devices-managed-by-fortios/801187/ha-mode-forti...

Adolfo Z.H

E-TAC Secure Acess Team LATAM

[TecnetRuss]

Here's my take:

FortiLink Aggregate Mode (split interface, LACP = static):

Pros:

• automatically loop-tolerant (MSTP)
• link-level redundancy at FortiGate

Cons:

• only one FortiLink Aggregate port is active at a time (in split-interface mode), and all traffic cascades through single chain through a single port (potential performance bottleneck if not 10Gbe).
• mid-chain switch or link failures potentially breaks the chain affecting one or more switches.

FortiLink Hardware Switch Mode:

Pros:

• simple hub and spoke topology.
• all FortiLink hardware switch ports can be active at the same time, with traffic potentially only 1 "hop" away from FortiGate on their own uplink (no chain topology bottleneck).
• single switch/link failure should only affect that one switch

Cons:

• no link-level redundancy per switch.
• no virtual stacking.
• not automatically loop-tolerant (you have to fiddle with STP separately).

FortiLink MCLAG (active/active) on the other hand is the best of both worlds, if you can afford it.

Russ

NSE7

[Adolfo_Z_H]

Hi TecnetRuss, thanks for your collaboration, to complete your idea, LACP static also is not longer recomended, due all the reasons you mentioned on your comment, but per lastest best practices and

with MCLAG-ICL capable FSW units, we can use LACP active and use all agregated ports on LACP link between FGT and a pair of MCLAG-ICL peer group.

Please check on following links how to achieve it, and also take a look for all supported MCLAG topologies. 

https://docs.fortinet.com/document/fortiswitch/7.4.0/fortilink-guide/801208/transitioning-from-a-for...

https://docs.fortinet.com/document/fortiswitch/7.4.0/fortilink-guide/801194/deploying-mclag-topologi...

hope it helps and found it interesting for your deployments.

those are avaliable since 6.4.5! enjoy!

[qasimbashir6242]

Hello,

Deploying FortiLink as a hardware switch or an aggregate can have its own advantages and disadvantages. Let's explore both options:

Advantages of using FortiLink as a hardware switch:

Simplicity: Using FortiLink as a hardware switch can simplify your network design by eliminating the need for an additional switch device. It can streamline management and reduce the complexity of your network architecture.
Cost-Efficiency: Hardware switches can be cost-effective compared to aggregates since you don't need an extra physical switch. This might be advantageous for budget-conscious organizations.
Reduced Latency: Direct connectivity through a hardware switch might offer lower latency compared to going through an aggregate, potentially enhancing network performance for time-sensitive applications.
Disadvantages:

Limited Scalability: FortiLink hardware switches might have limitations in terms of scalability compared to aggregates. If your network grows significantly, hardware switches might become a bottleneck.
Limited Redundancy: Hardware switches might not provide the same level of redundancy as aggregates, which can offer redundant paths and enhanced reliability.
Advantages of using FortiLink as an aggregate:

Scalability: FortiLink aggregates can be more scalable, allowing you to connect more FortiGate units to the same aggregate, which can be beneficial for larger networks.
Redundancy: Aggregates offer redundancy by providing multiple paths, reducing the risk of network downtime due to a single point of failure.
Traffic Segmentation: Aggregates can help segment traffic more effectively, enhancing security and network organization.
Disadvantages:

Complexity: Aggregates introduce an additional layer of complexity to your network, which might require more configuration and management efforts.
Cost: Setting up aggregates might involve purchasing additional hardware, which could impact your budget.
Ultimately, the decision between using FortiLink as a hardware switch or an aggregate depends on your specific network requirements, scalability needs, redundancy goals, and budget considerations. Standardizing on one design could indeed simplify management and maintenance across the organization, but carefully evaluating the advantages and disadvantages of each approach in the context of your network's unique needs is crucial.

Best regards,
Qasim