Fortiswitch - VRRP is not working with Standalone MCLAG-ICL

[svictor2]

I am installing Standalone Fortiswitch FS-648F using MCLAG-ICL topology, critical issues were observed with VRRP and inter-VLAN routing functionality.

FS-SW-1 & FS-SW-2 connected through Port 55 & 56 as MCLAG-ICL link and all vlans allowed. 

L2 Vlans are 10,20,30,40,50
STP enabled and priority assigned as default. 
L3 vlan created and assigned IP's with VRIP 
FS-SW-1 is Master & FS-SW-2 Backup vrrp state
from FS-SW-1 Cli I am able to ping vrip for example 172.16.10.1 . (vlan 10)
When I ping from FS-SW-2 cli, i unable to ping vrip 172.16.10.1  (vlan10)

In sw-2 mclag-icl diag command output , it shows dormant role is SW-2. 
2nd switch is not responding for vrip 172.16.10.1 arp in MCLAG-ICL

Any solution for the issue ?
Is there any limitations with Fortiswitch VRRP with MCLAG-ICL ?

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

[Anthony_E]

Hi,

To troubleshoot VRRP not working with standalone MCLAG-ICL, follow these steps:

1. Enable VRRP Virtual MAC: Ensure that `vrrp-virtual-mac` is enabled for VRRP. This is crucial for VRRP operation.
2. Configure VRRP Sessions: Configure two VRRP sessions on each SVI (Switched Virtual Interface). - Set VRRP priorities to ensure there is a VRRP master on each MCLAG core.
3. Layer-3 Lookup: Verify that the layer-3 lookup for the VRRP virtual MAC address is enabled on the VRRP backup. This should be automatic.
4. Check MCLAG and Trunk Hashing: Ensure that MCLAG and trunk hashing are correctly configured.

This allows ingress packets on the VRRP backup core to be routed without crossing the ICL if an appropriate route is available

[wjanmayka_FTNT]

Hi Anthony, 

I see FS-624F/648F does not support VRRP with MCLAG topology. 
"https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/445b932d-c593-11f0-8b43-d2943e..."

Did your configure is Active-Standby VRRP ?
and in Feature-Matrix is VRRP Active-Active on MCLAG ? 

Please advise how to setup FS-624F MCLAG to work with VRRP and static route. Active-Standby is OK.

Regards,

Wittaya J.

[quintinmorrow]

I’ve seen VRRP fail in similar FortiSwitch standalone setups because it’s easy to miss how tightly it depends on the upstream FortiGate configuration. VRRP itself may look fine, but things like VLAN tagging, interface roles, or missing heartbeat traffic break it silently. Double-checking L2/L3 expectations and testing with packet captures helped me spot where the failover traffic was actually getting lost.

[wjanmayka_FTNT]

Hi,

   For me, FS-624F enable VRRP and Static route with MCLAG.

Regards,

Wittaya J.