Configuration MCLAG between Fortiswitches and Aruba

[Borys_DE]

Hallo everyone. 

I recently started working for a company that has this network topology.

I see that the Aruba switches are set to MСLAG with Fortiswitches, but from the Fortiswich side there are no MCLAG settings. At the same time, Fortiswiches are online and available through Fortigate. 

I tried to set up MСLAG on FortiSwitch, but I encountered the fact that the Aruba side is specified as native VLAN 4094, and there is no such VLAN on FortiSwitches, at least I don’t see it through Fortigate GUI.
Should I create a new VLAN with ID 4094 or is it better to change the native VLAN on Aruba?
I am confused that VLAN with ID 4094 is specified everywhere in Aruba settings as native and the network works.

[ebilcari]

VLAN 4094 is dedicated for FortiLink, you can try to change it in the Aruba or in the Fortiswitches.

Some details are shown here: Troubleshooting Tip: Change FortiLink management vlan from 4094 to customized management VLAN

[fricci_FTNT]

Hi @Borys_DE ,

You do not see VLAN 4094 on FortiGate GUI because it is the default management VLAN for managed FortiSwitches.
Regarding your question:
>>"Should I create a new VLAN with ID 4094 or is it better to change the native VLAN on Aruba?"
I would not change it and would leave it as it is.
From the FortiSwitch CLI you can check the default management VLAN with "show switch auto-network".

Are the Aruba switches directly connected by a LAG or single port? From the diagram they do not seem to be directly connected.

For a MCLAG configuration you can check the following documentation:
https://docs.fortinet.com/document/fortiswitch/7.2.8/administration-guide/860027/mclag

Please keep in mind that making MCLAG changes on the FortiSwitches might create brief network disruptions.
 
Best regards,

[Borys_DE]

Hi,

Here are the settings on each Aruba switch:

"interface lag 11 multi-chassis
description FTG1_X1_X2
no shutdown
no routing
vlan trunk native 4094
vlan trunk allowed 5,11,21,31,41,110,130,140,150,170,180,1606,1610,2110,2168,2505,2550,2998,4042,4047,4083,4088-4094
lacp mode active
spanning-tree port-type admin-edge
interface lag 12 multi-chassis
description FTG2_X1_X2
no shutdown
no routing
vlan trunk native 4094
vlan trunk allowed 5,11,21,31,41,110,130,140,150,170,180,1606,1610,2110,2168,2505,2550,2998,4042,4047,4083,4088-4094
lacp mode active
spanning-tree port-type admin-edge
interface lag 21 multi-chassis
description FSw1_P51_P52
no shutdown
no routing
vlan trunk native 4094
vlan trunk allowed 5,11,21,31,41,110,130,140,150,170,180,1606,1610,2110,2168,2505,2550,2998,4042,4047,4088-4094
lacp mode active
spanning-tree root-guard
interface lag 22 multi-chassis
description FSw2_P51_P52
no shutdown
no routing
vlan trunk native 4094
vlan trunk allowed 5,11,21,31,41,110,130,140,150,170,180,1606,1610,2110,2168,2505,2550,2998,4042,4047,4088-4094
lacp mode active
spanning-tree root-guard
interface lag 23 multi-chassis
description FSw3_P51_P52
no shutdown
no routing
vlan trunk native 4094
vlan trunk allowed 5,11,21,31,41,110,130,140,150,170,180,1606,1610,2110,2168,2505,2550,2998,4042,4047,4088-4094
lacp mode active
spanning-tree root-guard
interface lag 24 multi-chassis
description FSw4_P51_P52
no shutdown
no routing
vlan trunk native 4094
vlan trunk allowed 5,11,21,31,41,110,130,140,150,170,180,1606,1610,2110,2168,2505,2550,2998,4042,4047,4088-4094
lacp mode active
spanning-tree root-guard"

As I understand it, both Fortigates and FortiSwitches are connected to Aruba via MCLAG. But the lack of any settings on the FortiSwitches side confuses me. MCLAG must be configured on both sides, otherwise it simply does not work.

[fricci_FTNT]

Hi @Borys_DE ,

Regarding your doubt:
>>"But the lack of any settings on the FortiSwitches side confuses me. MCLAG must be configured on both sides, otherwise it simply does not work."
If you want to have MCLAG from the point-of-view of the FortiSwitches towards the Aruba, then yes, you have to configure them on FortiSwitches as well. If MCLAG is not configured on FortiSwitches towards the Aruba, the traffic will flow according to the spanning tree.
Hope this helps.

Best regards,

[Borys_DE]

Hi @fricci_FTNT ,

thank you for your answer, but what about nod-level redundency?  If one of the Aruba switches is disconnected, traffic will simply go through the second switch, am I right?

[fricci_FTNT · Accepted solution]

Hi @Borys_DE ,

Correct, if one of the Aruba switches dies, the spanning tree will be recalculated and the traffic will go through the other Aruba switch.

Best regards,

[ebilcari]

The Aruba switches should be also configured for VSX/MCLAG, when one switch dies the LAG will remove the faulty link from its calculations.