Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
The_Nude_Deer
Contributor

FortiAP With Cisco Switch

Hi, Having a little difficulty with this, I have a FortiAP plugged into a CISCO 3750, port is trunked with native VLAN 50 , LLDP is enabled. Cisco is connected to another Cisco 9K , vlan 50 trunked and LLDP enabled there also. Fortigate (7.0.14) has a Layer 3 Aggregate inteface connected to the Cisco 9K, no issues there.

 

In order to get the AP MGMT, I created an SVI 50, with DHCP etc, and put it behind the Agg Layer 3, this is where I think there is a problem, I allow ALL traffic for now, but the AP will not come online, simply says "no LLDP neighbours found"

 

if I do "diagnose lldprx neighhour" you can see the Cisco 9K, and the Cisco 9K can see the 3750 as an LLDP neighbour, so not sure why the AP cannot get to the SVI on the Fortigate, I did notice on the SVI you cannot set "recieve LLDP" or "Transmit LLDP" the option isnt there..

 

I have enabled security fabric, you can see the AP MAC on the cisco switches on VLAN 152..any suggestions where I have made a silly mistake??

THankyou

1 Solution
Toshi_Esumi
SuperUser
SuperUser

Ok I missed one post when I went to grab food for lunch. So the SW 9K is not extending the VLAN ID 50 from the FGT toward the FAP? Then DHCP on the FGT would never work for the FAP. It has to be on the same L2 network. You have to set DHCP server on the switch where FAP is connected to it via L2 network.

View solution in original post

24 REPLIES 24
The_Nude_Deer

Nothing coming in at all, when I set up an SVI in vlan 50 on the switch, and open a session and ping it, it is just an arp request:

 

interfaces=[FortiAP-MGMT]
filters=[net 10.10.50.0/24]
2024-01-11 19:57:29.672476 FortiAP-MGMT -- arp who-has 10.10.50.10 tell 10.10.50.1

this traffic does go over BGP from the last switch to Fortigate, but that should make a difference as the routes are there

Toshi_Esumi

On the LAG/Portchannel interface on the SW 9K to the FGT, VLAN 50 is "tagged", right? Not the native-vlan.

The_Nude_Deer

The 9K to the Fortigate is BGP routed, The Fortgate advertises its "connected" FortiAP-MGMT interface to the 9K I can see the subnet being advertised to it.

 

CORE-9300T-WAN#show ip bgp neighbors X.X.X.X received-routes


*> 10.10.50.0/24 X.X.X.X  (X.X.X.X being the Fortgiate interface)

Toshi_Esumi

No. It's not about L3 routing issue. If L2 is connected, you should see something in the sniffing, which you don't see any. That ARP indicates the FGT is looking for the MAC address of the device that has 10.10.50.10, buy not getting any reply from the switch side.
It's L2 disconnection between the swtiches and the FGT.

All those FGT VLANs on the LAG interfaces are always tagged including VLAN ID 50. But I'm guessing VLAN 50 is untagged as the native VLAN on the 9K SW. That's why it's not connected.

 

Toshi

The_Nude_Deer

there is only L3 between the Fortigate and the switch, then layer 2 accross the other switches  to the AP

The_Nude_Deer

I do appreciate your help, I just cant figure out whats wrong!

Toshi_Esumi

And, the BGP TCP messages must be exchanged NOT over VLAN 50 but something else, which the X.X.X.X is riding on. That's why it shows in the received-route. I'm guessing that IS the untagged interface, or the LAG interface.

The_Nude_Deer

The x.x.x.x is the layer 3 IP address that forms the BGP, you can't tag vlans on that interface

Toshi_Esumi

I don't have any more ideas to troubleshoot this on the FGT side.

I haven't touched any Catalyst for many years, besides I would assume C9K switch would have different VLAN related commands different from 2K, 3K series. So I don't know the exact commend you can use to check tagged VLANs on the trunked LAG interface. But I would make sure if the VLAN 50 shows up in the command as tagged.

 

Toshi

The_Nude_Deer

I don't think it will.work anyway  , it's layer 2 discovery, as soon as it gets to the layer 3 switch it has nowhere to go, it has no idea what ip address to discover from..I think I'll have to find a way to bypass the routing altogether

 

Thankyou

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors