FortiAP With Cisco Switch

[The_Nude_Deer]

Hi, Having a little difficulty with this, I have a FortiAP plugged into a CISCO 3750, port is trunked with native VLAN 50 , LLDP is enabled. Cisco is connected to another Cisco 9K , vlan 50 trunked and LLDP enabled there also. Fortigate (7.0.14) has a Layer 3 Aggregate inteface connected to the Cisco 9K, no issues there.

In order to get the AP MGMT, I created an SVI 50, with DHCP etc, and put it behind the Agg Layer 3, this is where I think there is a problem, I allow ALL traffic for now, but the AP will not come online, simply says "no LLDP neighbours found"

if I do "diagnose lldprx neighhour" you can see the Cisco 9K, and the Cisco 9K can see the 3750 as an LLDP neighbour, so not sure why the AP cannot get to the SVI on the Fortigate, I did notice on the SVI you cannot set "recieve LLDP" or "Transmit LLDP" the option isnt there..

I have enabled security fabric, you can see the AP MAC on the cisco switches on VLAN 152..any suggestions where I have made a silly mistake??

THankyou

[The_Nude_Deer]

Nothing coming in at all, when I set up an SVI in vlan 50 on the switch, and open a session and ping it, it is just an arp request:

interfaces=[FortiAP-MGMT]
filters=[net 10.10.50.0/24]
2024-01-11 19:57:29.672476 FortiAP-MGMT -- arp who-has 10.10.50.10 tell 10.10.50.1

this traffic does go over BGP from the last switch to Fortigate, but that should make a difference as the routes are there

[Toshi_Esumi]

On the LAG/Portchannel interface on the SW 9K to the FGT, VLAN 50 is "tagged", right? Not the native-vlan.

[The_Nude_Deer]

The 9K to the Fortigate is BGP routed, The Fortgate advertises its "connected" FortiAP-MGMT interface to the 9K I can see the subnet being advertised to it.

CORE-9300T-WAN#show ip bgp neighbors X.X.X.X received-routes

*> 10.10.50.0/24 X.X.X.X  (X.X.X.X being the Fortgiate interface)

[Toshi_Esumi]

No. It's not about L3 routing issue. If L2 is connected, you should see something in the sniffing, which you don't see any. That ARP indicates the FGT is looking for the MAC address of the device that has 10.10.50.10, buy not getting any reply from the switch side.
It's L2 disconnection between the swtiches and the FGT.

All those FGT VLANs on the LAG interfaces are always tagged including VLAN ID 50. But I'm guessing VLAN 50 is untagged as the native VLAN on the 9K SW. That's why it's not connected.

Toshi

[The_Nude_Deer]

there is only L3 between the Fortigate and the switch, then layer 2 accross the other switches  to the AP

[The_Nude_Deer]

I do appreciate your help, I just cant figure out whats wrong!

[Toshi_Esumi]

And, the BGP TCP messages must be exchanged NOT over VLAN 50 but something else, which the X.X.X.X is riding on. That's why it shows in the received-route. I'm guessing that IS the untagged interface, or the LAG interface.

[The_Nude_Deer]

The x.x.x.x is the layer 3 IP address that forms the BGP, you can't tag vlans on that interface

[Toshi_Esumi]

I don't have any more ideas to troubleshoot this on the FGT side.

I haven't touched any Catalyst for many years, besides I would assume C9K switch would have different VLAN related commands different from 2K, 3K series. So I don't know the exact commend you can use to check tagged VLANs on the trunked LAG interface. But I would make sure if the VLAN 50 shows up in the command as tagged.

Toshi

[The_Nude_Deer]

I don't think it will.work anyway  , it's layer 2 discovery, as soon as it gets to the layer 3 switch it has nowhere to go, it has no idea what ip address to discover from..I think I'll have to find a way to bypass the routing altogether

Thankyou