FortiGate-200F mgmt port disconnected by storm control after reboot and make it primary

[martinoles]

Hi all,

I am running A-P cluster of FortiGate-200F with FortiOS 7.2.10 connected to management network consisting of Juniper EX4400-48T and I am observing:

- when node was in secondary and I will failover to make it primary, everything works as expected

- when node was rebooted, being secondary and I will failover to make it primary, on switch facing MGMT port I do observe twice hit storm control:

Dec 4 11:44:26 EX4400-48T l2ald[38686]: L2ALD_ST_CTL_IN_EFFECT: ge-0/0/19.0: storm control in effect on the port
Dec 4 11:44:26 EX4400-48T l2ald[38686]: L2ALD_ST_CTL_DISABLED: ge-0/0/19.0: storm control disabled port
Dec 4 11:49:17 EX4400-48T l2ald[38686]: L2ALD_STCTL_IF_RECOVERY: ge-0/0/19.0: storm control enabled port. Port recovered on 'Clear ethernet-switching recovery-timeout'
- manual clearing of storm control

Dec 4 11:49:22 EX4400-48T l2ald[38686]: L2ALD_ST_CTL_IN_EFFECT: ge-0/0/19.0: storm control in effect on the port
Dec 4 11:49:22 EX4400-48T l2ald[38686]: L2ALD_ST_CTL_DISABLED: ge-0/0/19.0: storm control disabled port
Dec 4 11:50:09 EX4400-48T l2ald[38686]: L2ALD_STCTL_IF_RECOVERY: ge-0/0/19.0: storm control enabled port. Port recovered on 'Clear ethernet-switching recovery-timeout'
- second storm control manual clean
- everything then works as designed
- no storm control issue on production ports or HA ports
- when reboot is due to FortiOS upgrade, issue with storm control is not observed

Storm control is set to 100M of BUM traffic on 1G physical interface
Unfortunately, it is in production environment, so it is a bit tricky to replicate the issue for TAC engineer.

What exactly should happens on MGMT interface, when node become primary? GARP for sure, but anything else?
What might cause to produce more than 100Mbps of BUM traffic such suddenly?
Thank you for any suggestion.

[kaman]

Hi martinoles,

We would need to collect some data on your environment. That means we will need you to reproduce the issue again and while it is in place capture the following outputs:

get sys pref stat -> run a few times

diag sys session stat

diagnose hardware deviceinfo nic <agg member interfaces>
diagnose netlink interface list <aggregate interface>
diagnose netlink interface list <agg member interfaces>
diagnose netlink aggregate name <aggregate interface>

diag npu np7 dce-drop-all all

diag sniffer packet <aggregate interface>

However, my personal recommendation is to upgrade to the officially recommended version as you are using firmware version 7.2.10, which is Out Of Engineering support.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Recommended-Release-for-FortiOS/ta-p/22717...

Regards

[Toshi_Esumi]

@kaman Doesn't the 200F have np6xlite instead of np7?
https://docs.fortinet.com/document/fortigate/7.6.4/hardware-acceleration/336140/fortigate-200f-and-2...

Toshi

[martinoles]

We do observe issue on MGMT interface. The MGMT interface is not connected to the NP6XLite processor. Production interfaces behave as expected. Node in cluster must be rebooted, being secondary, then switch to active. Production and HA works as expected carrying traffic, but MGMT port is blocked due to storm control on the switch side (Juniper EX4400-48T), 1G metallic interface with storm control threshold 100Mbps.