Changing ports under an LACP aggregate link

[brucetheloon]

On FortiGate 5.6, I've currently got 2 1G ports linked in a LACP aggregate team to a Cisco switch. We are wanting to migrate to a single 10G link via a different switch with as little disruption as possible. The LACP interface configured directly with an IP address (no vlans) and is linked to a number of address and policy elements.

Is it possible to remove the two 1G ports and add the 10G port to the aggregate interface in one operation? I assume the 10G would have to be set up as the only member of a LACP aggregate on the Cisco side.

I know the guaranteed way would be to move the IP across to the 10G port and then migrate the address and policy elements, but this would be quicker.

[lobstercreed]

I would say the guaranteed way is to do it in 2 operations.  Add the 10G port, save, then remove the 1G ports, save.  Either way, you should only have seconds of downtime (STP re-convergence on your Cisco switches might be the longest part).

[ede_pfau]

100% agreed. Just to clarify: lobstercreed means to add the 10G port to the existing aggregation.

If you use the 10G port outside the LACP aggregation, you would need to rewrite all policies as well.

You'll notice the most convenient feature of an LACP trunk is that you can add or subtract member ports without any further disruption.

BTW, I seem to remember that STP should be disabled on FGT links anyway.

[boneyard]

are you both sure that you can add a 10gig port to an existing link aggregate of 1gig? im pretty sure it won't work correctly, but im not sure if the fortigate will allow it configuration wise.

too late now, but if you use zones you could move interfaces into / out of it quiet easily.

[lobstercreed · Accepted solution]

I have some extra 1G and 10G ports (not in use) on my production firewall, so I gave it a shot for y'all.  Yes, you can do all of the above.  You can do it 1 step as OP asked, you can do it in 2 steps as I suggested, or of course you could redesign things as others have suggested. 

The LACP config doesn't care about link speed; only the actual operation would be affected.  However, that will be affected anyway when he moves from one switch to the other.  This should minimize the disruption.

Note: running a 1500D HA pair on 6.4.2