Fortigate 100E HA with Fortilink to FortiSwitch 148F planning

[mr_vaughn]

We have a Fortigate 100E HA.

We are planning switch replacements on the lan side, about 8 of them across 3 floors/4 IDF's. Planning to use FortiSwitch 148F-FPOE with the FortiLink's

Plan is to have 2 local FortiSwitches to the Fortigate HA and 2 other FS in each IDF

Concerns around how FortiLink works on the uplink from FortiSwitches. We want to use 10Gb on the Lan uplinks between switches.

There is fiber between floor but we need to check if it is Multimode and if 50 or .62.5 (likely) or Single Mode.

Some IDF's are using Cat6 copper for uplinks.

So planning 10Gb back bone will be a challenge.

I have read many FortiLink docs' and it is so hard to clearly define features and functions.

Questions on FortiLink.

1. Does FortiLink on 100 series bond the 1Gb links into a trunk between 2 of the same switches?

2. Does Fortilink stack switches if they are in a loop to form like a stack ring? e.g. Having each switch linked to each other. A to B to C to A.

3. Can the FortiLink be bonded to 2 or more ports on a Fortigate?

4. If there are 2 or more links going from two Fortigates 100E to two FortiSwitches 100F series does it bond the links uplinks to have greater than 1Gb bandwidth?

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Wuggles14]

Hi there,

Lets go with your questions

1. As you can't build MCLAG on the 100 series switches, you will have to use FortiLink split interface; which means only one of the links from the Gate to the Switching will be active at any one time

2. Yep, that will form the logical stack if you connect as a loop

3 & 4. I think, as you are limited/without the option for MCLAG on the switching, so will have to use the split interface FortiLink config, then I don't think you'll be able to bond interfaces

These Forti docs are the ones relevant to you, me thinks

HA-mode FortiGate units managing a stack of several FortiSwitch units | FortiSwitch 7.0.8 | Fortinet...

HA-mode FortiGate units managing a FortiSwitch two-tier topology | FortiSwitch 7.0.8 | Fortinet Docu...

[mr_vaughn]

Thanks for the response.

I knew the FS1xx series had no MCLAG. thus the challenge.

in 7.2.x there is an option to use 8023ad LAG's into the Fortigate Fortilink Interface. We could create a 4Gb trunk to each Fortigate Fortilink interface. How is the LAG created on the Fortiswitch? automatically or manually before being joined to the Fortigate for admin?
Section 2.1  Custom FortiLink interfaces

https://docs.fortinet.com/document/fortiswitch/7.4.2/fortilink-guide/173260/configuring-fortilink#2.

The split Fortilink interface will only create availability. for failover , Since we have Fortigate HA , we can use Link monitor in HA and failover to another FGT. 

We want to add bandwidth since there will be inter vlan routing via the FGT between servers and workstations.

[Wuggles14]

Ah, I'm with you

So you're happy with the split interface (as long as you bundle some ports for more bandwidth down to them)

But it's the ISL/link between the 2 switches on the end of the FortiLink interfaces that's the issue?

Not set it up before so not entirely sure how it would behave without testing but can you do an 802.3ad LACP bundle on the 148s but just disable MCLAG on it?

Adding 802.3ad link aggregation groups (trunks) | FortiSwitch 7.4.2 | Fortinet Document Library

[mr_vaughn]

I know we can do the LACP trunk on the FS1xx  but question is if it can be bound a single FortiLink interface to the FGT. and if so how is it configured.

[mr_vaughn]

I think this answers my question. 

https://docs.fortinet.com/document/fortiswitch/7.2.6/fortilink-guide/801187/ha-mode-fortigate-units-...

and 

https://docs.fortinet.com/document/fortiswitch/7.2.6/fortilink-guide/801190/ha-mode-fortigate-units-...