Fortigate 1100 LACP Problem

[Rehad]

Hello,

We have a Fortigate 1100 connected to a Cisco NX-3548 with 2 LACP links for WAN internet access . In some heavy network traffic days ( three times  in six months )  Both of two LACP links to Cisco NX gets blocked. I am thinking that LACP flapping occurs. 

These are 10G fiber connections. Are stock transceivers can be a cause of this problem ?

Thanks

[Rehad]

I have read the Fortigate document about interface integration wizard unfortunately the below explanation says that we can't do this operation;

---

"The interface migration wizard does not support turning an aggregate, software switch, redundant, zone, or SD-WAN zone interface back into a physical interface."

[Rehad]

What i am thinking , i will use another port for  wan internet access . I will create one by one each firewall rule for this new port ( it will take some time but its doable ) . I will disable old connections ( SD-WAN , LACP etc ) and i will move to this new port .

[AEK]

Yes you can do so.

To speed up the change you can use cli script so you can do it much faster.

Just make a good plan and test it in your lab.

[Rehad]

Ok thanks , i will use cli scripts.

[jpcastilloux1]

Have you resolved your problem ?

We are experiencing something that's look the same.

We have LACP communication problem with a 600E.

LACP doesnt goes down, always up, but we have traffic unstability.

If we ping the gateway using this LACP ( while being in the same VLAN ), we are losing a lot of ping...like a arp poising problem or arp conflict...but there is not, everything has been verified.

BUT ! If we hard reboot the cluster ( by unpluging the power cable, not only the reboot button in the GUI ), the problem is resolved UNTIL a LACP member is down for a moment ( by manually shutting down the port by CLI or physicaly unpluging it from the switch ).
When this happens, all the problems comes back until we hard reboot again the cluster....

Very strange behavior...

[Rehad]

Hi jpcastilloux,

We understood that the root of the problem was some DDOS attacks. The instability happens under heavy internet traffic. We have two ISPs for Internet connection . One is primary and the other secondary . To minimize the incoming internet traffic we have switched the ISP and selected the slower one for the first priority. Slower ISP speed is 1 Gbit/sec . 

After this we don't faced any problem on the LACP link.

We were planned to remove the LACP but as we didn't have a problem anymore we didn't do that. 

[Rehad]

Also i have to mention that the ISP that we have selected as the first priority has better infrastructure for preventing DDOS attacks.