Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Rehad
New Contributor II

Fortigate 1100 LACP Problem

Hello,

 

We have a Fortigate 1100 connected to a Cisco NX-3548 with 2 LACP links for WAN internet access . In some heavy network traffic days ( three times  in six months )  Both of two LACP links to Cisco NX gets blocked. I am thinking that LACP flapping occurs. 

 

These are 10G fiber connections. Are stock transceivers can be a cause of this problem ?

 

Thanks

16 REPLIES 16
Rehad
New Contributor II

I have read the Fortigate document about interface integration wizard unfortunately the below explanation says that we can't do this operation;

 


"The interface migration wizard does not support turning an aggregate, software switch, redundant, zone, or SD-WAN zone interface back into a physical interface."
Rehad
New Contributor II

What i am thinking , i will use another port for  wan internet access . I will create one by one each firewall rule for this new port ( it will take some time but its doable ) . I will disable old connections ( SD-WAN , LACP etc ) and i will move to this new port .

AEK

Yes you can do so.

To speed up the change you can use cli script so you can do it much faster.

Just make a good plan and test it in your lab.

AEK
AEK
Rehad
New Contributor II

Ok thanks , i will use cli scripts.

jpcastilloux1
New Contributor

Have you resolved your problem ?

 

We are experiencing something that's look the same.

 

We have LACP communication problem with a 600E.

LACP doesnt goes down, always up, but we have traffic unstability.

If we ping the gateway using this LACP ( while being in the same VLAN ), we are losing a lot of ping...like a arp poising problem or arp conflict...but there is not, everything has been verified.

 

BUT ! If we hard reboot the cluster ( by unpluging the power cable, not only the reboot button in the GUI ), the problem is resolved UNTIL a LACP member is down for a moment ( by manually shutting down the port by CLI or physicaly unpluging it from the switch ).
When this happens, all the problems comes back until we hard reboot again the cluster....

 

Very strange behavior...

Rehad
New Contributor II

Hi jpcastilloux,

 

We understood that the root of the problem was some DDOS attacks. The instability happens under heavy internet traffic. We have two ISPs for Internet connection . One is primary and the other secondary . To minimize the incoming internet traffic we have switched the ISP and selected the slower one for the first priority. Slower ISP speed is 1 Gbit/sec . 

 

After this we don't faced any problem on the LACP link.

 

We were planned to remove the LACP but as we didn't have a problem anymore we didn't do that. 

 

 

Rehad
New Contributor II

Also i have to mention that the ISP that we have selected as the first priority has better infrastructure for preventing DDOS attacks.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors