FortiOS 6.4.0: How to use Q-in-Q vlan interface?

[kliew]

on a FortiGate101E with 6.4.0, I can see that under config system interface the option for 802.1AD is there

# set vlan-protocol 8021q     IEEE 802.1Q. 8021ad    802.1AD.

but unfortunately could not figure out how to set the second-dot1q vlan tag ID?

Is this feature actually completed or still under wraps?

Thanks in advance,

Kenneth

[josh]

Also interested in this. Does the sub-interface you're creating in this step just get attached to an already tagged parent-interface in which case the one you're creating becomes the inner-tag?

[DTS]

Have you made any progress with this? I have 2x200F HA units that I am trying to get working with QinQ tagging. Our ISP is handing off VLAN tagged frames to the FG, where we need to strip the outer tag to then allow the tagged (Nested) VLANS to reach their corresponding FG interface/vlan. We then send out "double tagged" frame with the outer matching the client/customer site. THe provider then strips outer VLAN when frames arrive at site and before hitting switch interface, so we are left with layer 2 destination VLANS. Provider then accepts single tagged packets on the return and tags them on the 'outside' with the 'site' vlan with the single tagged frames encapsulated inside before they reach the FG. 

I've been waiting on answers from FG support for a few days. I've been told several times that it is an 'advanced' feature that is "rarely" used which is interesting because the features/options are there are were added to firmware recently and for good reason, you would think? 

[kliew]

You're lucky to have been able to get hold of those FG200F units ... IngramMicro here say they'll only be available sometime in Q2-2021.. any did you manage to get some answers from Fortinet Support on getting it to work with your FG200F ?  The last time I opened a support for this 8021ad feature they told me it's not supported for SOC3 & SOC4 platforms (which was why it didn't work on my FG60F)

== from their reply == "I tried to find an document to provide the information but there was no external links but SOC3 & SOC4 are not supported. I have double checked internally and providing you this information. "

==

It shows how low the priority Fortinet has placed this 8021ad feature... it seems like it could have been done in a hurry for their 6.4 release just to satisfy some large customer's sales response check box to say that yes, we support stacked-vlans but in the real-world they have not actually got the code properly implemented, documented, tested (wishful thinking..)

[Adrian_Lewis]

In case any else comes across this, I tested this on a FortiGate 60E (SoC3) and the config appears to work. Not tested actual traffic over the link but here's the config:

edit "s-tag" set vdom "root" set vlan-protocol 8021ad set device-identification enable set role lan set snmp-index 11 set interface "wan2" set vlanid 801 next edit "c-tag" set vdom "root" set device-identification enable set role lan set snmp-index 12 set interface "s-tag" set vlanid 1801 next