Fortigate 100F 10G interface with FN-TRAN-SFP+SR not comming up

[MMGE]

Dear All,

I have following connection:

CIsco Switch - SFP-10G-SR - om3 MMF cable 3 meter - FN-TRAN-SFP+SR - FortiGate 100F, X2 port.

Previewsly I used SFP-10G-SR on both devices, link was worked, bot after installing FN-TRAN-SFP+SR link goes down.

I have more then one FN-TRAN-SFP+SR, but same result for all modules.

Does anyone knows why these SFP-s do not wan to takl with each other?

Thanks in advance.

[funkylicious]

hi,

that's quite strange. could it be that you have manually set on Cisco side the port to speed 10G and on FGT side auto-negotiation is enabled and thus failing? do you have any logs on the Cisco side or just the generic link down log?

try setting the speed manually of the interface on the FGT.

[MMGE]

Hi,

Thanks for response.

Here are configuration fragments:

Cisco:

interface Port-channel4

description TO_FGT100_DMZ
switchport trunk allowed vlan XXXXXXXXXX
switchport mode trunk
logging event trunk-status
logging event bundle-status
logging event spanning-tree

interface TenGigabitEthernet1/0/4
description PO_4
switchport trunk allowed vlan XXXXXXXXXX
switchport mode trunk
logging event trunk-status
logging event bundle-status
logging event spanning-tree
channel-protocol lacp
channel-group 4 mode active

interface TenGigabitEthernet2/0/4
description PO_4
switchport trunk allowed vlan XXXXXXXXXX
switchport mode trunk
logging event trunk-status
logging event bundle-status
logging event spanning-tree
channel-protocol lacp
channel-group 4 mode active

FGT:

config system interface
edit "PortChanX1-X2"
set vdom "root"
set allowaccess ping fgfm fabric
set type aggregate
set member "x1" "x2"
set device-identification enable
set lldp-reception enable
set lldp-transmission enable
set monitor-bandwidth enable
set role dmz
set snmp-index 36
set ip-managed-by-fortiipam disable
next
end

I can't see any error log on Cisco side.

[funkylicious]

try setting the speed on x1 manually to 10G, as per https://community.fortinet.com/t5/FortiGate/Technical-Tip-Changing-the-speed-of-a-FortiGate-interfac... 

[MMGE]

Interfaces configured as in document.

Same result.

Device FW version is 7.6.2

Here is an output of command:

diagnose hardware deviceinfo nic x2
Description :FortiASIC NP6XLITE Adapter
Driver Name :FortiASIC NP6XLITE Driver
Board :100F
lif id :19
lif oid :83
netdev oid :83
Current_HWaddr e8:ed:d6:06:46:0a
Permanent_HWaddr e8:ed:d6:06:46:0b
========== Link Status ==========
Admin :up
netdev status :down
autonego_setting :0
link_setting :1
speed_setting :10000
duplex_setting :1
Speed :0
Duplex :N/A
link_status :Down
============ Counters ===========
Rx Pkts :4410131036
Rx Bytes :418971399797
Tx Pkts :6645923932
Tx Bytes :4639186005759
Host Rx Pkts :4168129286
Host Rx Bytes :242665272510
Host Tx Pkts :5468641402
Host Tx Bytes :3924345036636
Host Tx dropped :0
FragTxCreate :0
FragTxOk :0
FragTxDrop :0
sw_rx_pkts :4410125157
sw_rx_bytes :460194850472
sw_rx_mc_pkts :10429313
sw_rx_bc_pkts :357267
sw_tx_pkts :6645915121
sw_tx_bytes :4669819690962
sw_tx_mc_pkts :962052
sw_tx_bc_pkts :450013

[AEK]

Hi MMGE

I don't have much knowledge in SFPs but if it can help I already faced same issue where some third party SFP+ (on Huawei router) was not compatible with Fortinet's SFP+. We fixed it by changing the third party SFP+ by another brand.

[MMGE]

Thanks for response, AEK,

As I mentioned in first post, when I install Cisco SFP-10G-SR in both devices, link of port-channel goes up, and I used it previously, but in FortiGate GUI there is an warning message, so I decided to plug there required SFP - Fortinet FN-TRAN-SFP+SR, after this link goes down.

[Toshi_Esumi]

While FGTs generally don't care much about SFP/SFP+ manufacturers, Cisco devices check the vendor ID in the SFP/SFP+ and reject if it's not Cisco compatible one. You likely need to have a Cisco compatible SFP+ on its end. The FN-TRANS ones might not be accepted by the Cisco. 

Toshi

[MMGE]

Hi,

Thanks for response.

My topology is:

Cisco Switch with installed SFP-10G-SR,

FGT100F with installed FN-TRAN-SFP+SR and OM3 MMF between them.

These communication have a problem - link status on cisco switch is noconnect.

Before I used SFP-10G-SR sfp-s installed in both devices, and they worked perfect.

[Toshi_Esumi]

The first config you showed had Port-channel/Link aggregation is configured. Are you saying Ten1/0/4 - X1 comes up but Ten1/0/5 - X2 doesn't come up?
Then what kind of warning did you get when it had a SFP-10G-SR on X2 before?

Toshi