FortiSwitch STP Issues Interoperating with Cisco Switches PVST+

[Dan_Eng52]

Hi all, 

I hope you're well. 

I have 4 x FortiSwitch 448E-FPOE devices with two operating as MCLAG peers and the remaining two switches connecting via MCLAG ISL trunks. The switches are currently running version: FortiSwitch-448E-FPOE v7.4.2,build0801,231207 (GA). These switches terminate links to our redundant data centres housing Cisco infrastructure operating RPVST+. 

From reviewing the Fortinet documentation, this should have been as simple as setting the set rpvst-port enable command but despite the FortiSwitch receiving BPDU’s from the Cisco environment and displaying the correct root bridge within the RPVST+ domain the FortiSwitch wasn’t sending any traffic over the intersite link correctly. This meant that we couldn’t receive any network services (DHCP, DNS etc) and get any connectivity on-site and having reviewed the port stats we were getting a lot of TX discards.

We also tried to establish a trunk of which was established succesfully but would not pass traffic. Initially on the port connected to the Cisco environment we had the following flags: IC(PVST Port Inconsistent), MV(PVST Port Vlan Mismatch) the latter was resolved by ensuring the allowed-vlans matched both ends however, despite the native/allowed VLAN’s matching both sides of the link we could still see the IC(PVST Port Inconsistent) in the STP instance and no matter what we tried it remained. Because of the interoperability issues with the Cisco STP domain we’ve had to run this off a single link and disable spanning-tree which despite not being ideal was the only way connectivity could be gained.

Has anyone experienced these issues before interoperating FortiSwitch STP with Cisco and have any ideas  solution we could apply? I’m thinking this could potentially be a bug and perhaps a software downgrade would resolve the issue but unsure on what the best version to downgrade to would be. If anyone can recommend a stable version for me to apply, I will give this a go. 

Many thanks, 

Dan_Eng52

[Anthony_E]

Hello Dan,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello Dan,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

[Anthony_E]

Hello Dan,

Did you have a look at these documents?:

https://docs.fortinet.com/document/fortiswitch/6.4.2/administration-guide/364614/spanning-tree-proto...

https://docs.fortinet.com/document/fortigate/6.4.0/new-features/499186/inter-operability-with-per-in...

Tell us if it helped. If not, we will continue to look for an answer.

Regards,

[Tango1]

Hello Anthony

We are having similar issue in a customer environment. It is a new setup.

FGT cluster==Fortiswitches with ICL ==Cisco Catalyst Switch

MCLAG to Cisco catalyst switch. When administrator creates/deletes a VLAN on Fortilink on FGT, They loose the access to Cisco switch. rpvst-port is enabled on trunk interface on both FortiSwitches. FortiSwitch STP instance priority is set to 0 to make FortiSwitches act as root bridge. Any Fortiswitch version should i upgrade?

Thanks

ST

[ebilcari]

You can take a look at this thread here: https://community.fortinet.com/t5/Support-Forum/LACP-between-Cisco-and-Fortiswitch-MC-LAG-STP-error/...