Connect new FortiSwitches to Fortigate through HP-ProCurve Core-Switch

[HegnauerF]

Hello Everybody,

I hope someone can clarify a situation for me.

My Customer has existing 2x FGT100F with LACP (X1,X2) and around 30+ SVIs connected via L2-LACP-Link to HPE(Core) & NetGear(remote-cabinets) Switches running.

Now he bought 4 new FSW-148 (remote-cabinets) from me, but did not buy the 2x FSW-1024E for the Datacenter (Distribution-Layer). He want's to keep the 5406R from HPE (lots of 10G-SFP+ Ports) for Distribution-Purposes and Server-Connection.

I on the other hand wanted (of course) to use FortiLink to all the new Switches.

All the customers networks (VLANs 5 through 51 tagged - no VLAN1, no untagged) are on the existing LACP (X1&X2) to the HPE-Core.

Here are my three big questions:

1. Is there a chance (for now ;-)) to keep the HPE-Core and connect all new switches to 10G-Ports on the HPE and still manage the Switches througt fortilink?

2. Is it possible to use all the existing VLANs on the new Forti-Switches (aka. Bridge existing VLANs 5-51 to FortiLink, etc.)?

3. Is it possible to use FortiConverter to change the VLAN-Interfaces from X1&X2 to some other port(7-16), then create fortilink on X1&X2 (LACP), then move VLAN-Interfaces back to FortiLink and then connect the Fortilink-LACP again to the HPE-Core. Now i could distribute all Links (if possible) to the new Forti-Switches through the HPE-Core.

Is that even possible?

Explanation:

Why not connect to the new Forti-Switches (FSW-148F-FPOE with 4x 10G)?

I wanted to use MCLAG on Distri-Layer and i need 2x 10G for ICL and 1x 10G for Uplink to HEP and 1x 10G for Downlink to next Switch. So there are no ports left for distribution.

Also all the Servers are connected on HPE-Core. LAG with 8x 1G is no option, as Backup would exceed time-frame.

I hope, someone can give an explanation to me, what would be possible/thinkable.

THX Franz

[DPadula]

Hi HegnauerF,

Answering your questions:

1. Is there a chance (for now ;-)) to keep the HPE-Core and connect all new switches to 10G-Ports on the HPE and still manage the Switches through fortilink?

A.: Yes, as you can see on the link below you can have a Layer2 devices at the middle of a ISL link. 

https://docs.fortinet.com/document/fortiswitch/7.0.8/devices-managed-by-fortios/801183/fortilink-ove...

2. Is it possible to use all the existing VLANs on the new Forti-Switches (aka. Bridge existing VLANs 5-51 to FortiLink, etc.)?

A.: You want to have have all the existence vlan created on the FortiSwitch. So basically traffic traffic will flow from FGT, core switch and FortiSwitch, did I get it right? If I have, I don't see a reason why you could not 'extend' vlan 5-51 from the core to the FortiLink switches. 

3. Is it possible to use FortiConverter to change the VLAN-Interfaces from X1&X2 to some other port(7-16), then create fortilink on X1&X2 (LACP), then move VLAN-Interfaces back to FortiLink and then connect the Fortilink-LACP again to the HPE-Core. Now i could distribute all Links (if possible) to the new Forti-Switches through the HPE-Core.

Is that even possible?

A.: Regarding FortiConverter, I am not familiar with it, maybe one of my colleagues could help you answering this question.

To avoid down time I suggest you to replicate the customer scenario in LAB using their brand new FortiSwitches just to anticipate what you could find during a proper migration. 

[HegnauerF]

Hello @DPadula,

Thank You for your quick response.

Following up there i need to ask the really stupid question for your answer "#1"...

You wouldn't happen to know if i would need to transport an untagged VLAN (aka. "untagged vlan 1 == DEFAULT" or "untagged vlan 5") over the HPE-Core to allow passage of the L2-P2P for Fortilink? For now i had only tagged/trunked VLANs on the Uplink to Fortigate.

The already used management-VLAN is "tagged VL.5" but if i need a new untagged VLAN for Fortilink i would prefer it to be in a seperate Broadcast-Domain (aka. new VLAN - eg. "untagged vlan 7" only on the HPE-Core for free transport (seperated from all the other vlans).

What are your Insights/Ideas for that?

Thanks is advance for any Idea, that pushes me in the right direction

Franz