Fortigate 800C SFP+ Port

[mrandrew]

Will the FG-TRAN-GC (1000baseTX) SFP work in the SFP+ port of an 800C?  

I can do this with Cisco SFP+ ports.  They will take any 1Gig or 10Gig SFP.

You may be asking why.  Why use the SFP+ port when you have 4 other SFP 1Gig ports available.  I have 2 Fortigate 800C devices in HA.  One 800C is at the main site and the other is connected at the DR site.  HA runs over a 1Gig dedicated fiber.  The switch at the main site can utilize 10Gig, but the switch at the DR site does not have 10Gig ports.  

Thanks

[mrandrew · Accepted solution]

emnoc,

Thanks for reply.  I forgot that these FG800Cs shipped with 2 1Gig fiber SFPs.  I placed one into port 24.  I was required to set the port to speed 1000full in order for it to link to the Cisco switch.  The bad thing now is that when I make this change on the port it makes the change on the other Fortigate.  I want one FG800 to run at 10GB and the other at 1GB.  Unless there is a way to manually set each firewall independent of HA, then I'm stuck finding another way or purchasing a 10GB option for the DR site.

Thanks again,

Andrew

[emnoc]

Yes that is doable and  it will work.

Ken

[mrandrew · Accepted solution]

emnoc,

Thanks for reply.  I forgot that these FG800Cs shipped with 2 1Gig fiber SFPs.  I placed one into port 24.  I was required to set the port to speed 1000full in order for it to link to the Cisco switch.  The bad thing now is that when I make this change on the port it makes the change on the other Fortigate.  I want one FG800 to run at 10GB and the other at 1GB.  Unless there is a way to manually set each firewall independent of HA, then I'm stuck finding another way or purchasing a 10GB option for the DR site.

Thanks again,

Andrew

[ede_pfau · Accepted solution]

I was running into a similar requirement lately. Customer was about to upgrade his 1 Gbps WAN link to 10 Gbps. To keep the configuration identical (that is, the port number before/after) I wanted to use an SFP plug now and an SFP+ plug later in the same 10GE-port. In contrast to the docs which simply state "SFP+ port will accept SFP transceiver as well", the link didn't come up.

-> apparently there is no auto-negotiation if you use an SFP transceiver in an SFP+ port. If you pin it down to "1000full" it'll work. [Too late for me.]

[MikePruett]

Ede,

What kept you from just manually pinning it down on speed and duplex? Or did you not learn about that until after the project? Did something else come up that made you change your path?

[ede_pfau]

Well, onsite there was a little...pressure to proceed, and when the link didn't come up I just used another 1 GbE port. I wasn't thinking of the autonegotiation at that time, given that this is "just working" 100% of the time. I haven't even used a crossover cable in years now.

[mrandrew]

All,

I've successfully worked around the issue since I was required to manually set ports 23 and 24 at speed of 10000.  Auto negotiation was not going to work.   The best way to explain is with a diagram which I have attached.  

So, to recap, we have 2 Fortigate 800Cs in HA.  One is located at a primary site, the other is located at a DR site.  The sites are connected by a dedicated 1Gbps fiber connection.  The 800C at the primary site is connected to a Cisco 4507 switch that is capable of 10Gbps.  The 800C at the DR site is connected to a switch that only has 1Gbps ports.  I configured ports 5,6,7,8,23, and 24 on the 800Cs in a LACP bundle.  On the main site 4507, I configured only the 2 ports that connect to 23 and 24 on the 800C in the bundle.  The ports on the 4507 that correspond to ports 5,6,7, and 8 are shut down.  On the DR site switch, I configured the ports on the 3560-X that correspond to ports 5,6,7, and 8 on the 800C in the bundle.  There are no connections from the 800C to the 3560-X on ports 23 or 24.  So, the LACP bundles come up just fine on both sides.  I have a 20Gbps bundle at the main site and a 4Gbps bundle at the DR site.

Thanks all,

Andrew

[rwpatterson]

So basically at the HQ, you burned four GB ports in the HA bundle since you have the 10 G ports connected, and similarly at the remote you lost the 10GB ports since the Cisco didn't have any anyway. Pretty slick. My question: Why did you bundle a second 10 GB port on the HQ side? It now becomes unavailable for any other networking. You can push at most 4GB due to the four 1xGB connections on the remote...

[mrandrew]

Yes.  I pretty much bundle everywhere primarily for redundancy.  I do this for closet access switches as well.  If I lose a one, I'm still good.  The other point is that the HA is in active/passive.  So 99% of the time, all traffic is going through the main site 800C.  Also, in the bundle I utilize vlans so port density is not really a problem.  I have about 30 vlans configured to run over this bundle.  I only have a small set of ports that are configured as straight up physical ports.  (WAN1, WAN2, HA ports, and a couple of others).  I have 3 separate bundles.  One for inside (internal firewalling that runs over the 20Gbps), one for DMZ (2Gbps), and one for Wifi (2Gbps).

Andrew

[emnoc]

Keep in mind your bundle are over-engineered. Your noting to get 20gbps out a NP4 along with the other ports.