Fortigate 60F and Cisco ACI BPDU issue

[fortigeorge]

Hi,

I'm trying to connect a Fortigate 60F internal port to a Cisco N2K FEX switch as a management interface so I can manage it remotely through our lab setup.

The problem I'm having is once connected the switch is putting the port into an 'bpdu-guard-err-disabled' state.

I just wanted to confirm that an out of the box Fortigate 60F firewall in NAT mode wouldn't be sending spanning tree BPDU's out of the internal interface?

What I need is for this 'internal' port to behave like a regular access port.

[Dan_Eng52]

Hey Fortigeorge, 

I hope you're well. 

If this is the default 'internal' interface that is created from default, this is a virtual switch. Because you're connecting this to a device that has STP enabled for loop protection some changes to the FortiGate are required otherwise it will recognise this link as a blocked link such as in this case. 

You could disable STP entirely on the virtual-switch interface or at least disable forwarding of STP: 

config system interface
edit internal
set stp {enable | disable}
next

end

config system interface

edit internal

set stpforward {enable | disable}

set l2forward {enable | disable}

end

However, in your case I feel it would be better to use an individual L3 interface on the FortiGate rather than the virtual-switch. You can either remove one of the interfaces out of the default virtual-switch and connect this to a VLAN on the Cisco switch for connectivity with an IP address configured on the FortiGate interface to management. 

Or, if you aren't using the 'internal' interface, I would remove all references of that interface, delete the interface and you have all the ports available to use how you would like. As a part of my base builds, I delete the default virtual-switch as I do not use it in my builds. 

Try one of the above and let me know which one you use and if it works....it should!

Thanks, 

Dan.