Hello! I am not able to do a single ping to any of the VLANs on the trunk even when everything is up. need help.
The goal is to maintain a trunk to L2.
Each Fortigate has its own port-channel. LACP A-P.
Attached representative physical diagram.
Attached representative logic diagram; 1 Trunk for 5 vlans with a gw each.
Nexus config...
SWT01 | SWT02 |
interface Ethernet1/21 description FGT01-X1 switchport mode trunk switchport trunk allowed vlan 2,11,99-101 channel-group 40 mode passive no shutdown | interface Ethernet1/21 description FGT01-X2 switchport mode trunk switchport trunk allowed vlan 2,11,99-101 channel-group 40 mode passive no shutdown |
interface Ethernet1/22 description FGT02-X1 switchport mode trunk switchport trunk allowed vlan 2,11,99-101 channel-group 50 mode active no shutdown | interface Ethernet1/22 description FGT02-X2 switchport mode trunk switchport trunk allowed vlan 2,11,99-101 channel-group 50 mode active no shutdown |
interface port-channel40 speed 10000 description VPC Trunk to FGT01 switchport mode trunk switchport trunk allowed vlan 2,11,99-101 vpc 40 | interface port-channel40 speed 10000 description VPC Trunk to FGT01 switchport mode trunk switchport trunk allowed vlan 2,11,99-101 vpc 40 |
interface port-channel50 speed 10000 description VPC Trunk to FGT02 switchport mode trunk switchport trunk allowed vlan 2,11,99-101 vpc 50 | interface port-channel50 |
show port-channel summary All UP (interfaces, portchannel,vPC) | show port-channel summary All UP (interfaces, portchannel,vPC) |
|
|
Fortigates
FGTAE_HA1 # show system interface LAN config system interface edit "LAN" set vdom "root" set allowaccess ping https http set type aggregate set member "x1" "x2" set device-identification enable set lldp-transmission enable set monitor-bandwidth enable set role lan set snmp-index 39 next end |
FGTAE_HA1 # show system interface x1 FGTAE_HA1 # show system interface x2 |
Any ideas?
hi,
Vlan interfaces on FortiGate 'LAN' interface is the gateway for the vlans? Ping is from which source to which destination? Could you post the output of #diag netlink aggregate name LAN from *both* FortiGates?
Best regards,
Jin
LAN is the trunk that contains the gw of each vlan.
FGT to host (vlan100) > No ping
Host to FGT(100.252) > No ping
something more direct:
Nexus(99.190) to FGT(99.252) > No ping
FGT(99.252) to Nexus(99.190)> No ping
"diagnose netlink aggregate name LAN" the second is a passive slave
FGTAE_HA1 # diagnose netlink aggregate name LAN status: up member: x1 member: x2
|
Thanks
Do you have two vPC domains? Why are you using VPC 40 and VPC 50?
Can you show us the Nexus config for your VPC domain(s)? As well as your vPC Peer Link config.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2023 Fortinet, Inc. All Rights Reserved.