Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
minxminx
New Contributor

Hardware Switch

Hi,

Diagram below is my current configuration for 100Ds (soon will be replace with 80Fs). Right now my dell L2 switch (D1) is connected to Interface 1 with 3 VLAN. I'm going to add a cisco switch just in case if that D1 fails, I'm thinking to do Hardware Switch for interface 1 & 2.

My question:

1. Do I need to configure LAG in Fortigate for that new hardware switch?

2. What is the prefer configuration for this scenario? (without stacking since D1 is old)

3. Since I'm going to change from int to hardware, all policies have to be created again?

FG.png

Thanks,

Minx

7 REPLIES 7
gfleming
Staff
Staff

May I ask what the purpose of the D1, C1 switches is? I realize this is a basic diagram but seems like you could almost get rid of them and just use D2 stack which would simplify your configuration tremendously as you could create LAGs to the upstream FortiGates.

 

In the current topology you cannot use LAGs since the D1 and C1 switches are not communicating over a shared control plane.

 

If you have to use D1,C1 as intermediate switches be cautious about using a hardware switch because now you are introducing a loop (eg between FG1, D1, D2, C1, FG1 and FG2, C1, D2, D1, FG2, etc). You'll need to ensure STP is working to block interfaces. FG can forward STP packets but will not participate in STP in the sense that both those HW Switch Ports will not go blocking state.

 

It's on odd topology so let's start with figuring out if it's the best (or only) one to use. Then we can see how the FortiGates can be configured. Please provide feedback on your design for now.

 

 

Cheers,
Graham
minxminx
New Contributor

Thanks Graham,

D1, C1 are edge switches I still have 2 others that connected to both D2.

I inherited this topology, I thought D2 stack are connected to FG since HCI connect to that stack.

So what is prefer configuration for FG if i connect D2s to FG?

gfleming

I'm confused why you have edge switches between your core/distribution and your FortiGates. Edge switches would normally be between the FortiGate and the ISP routers.

 

Either way if you can connect the FortiGates directly to the D2 stack then you can have one LAG interfaces created on the FortiGate, with links split across the D2 Stack switches (assuming those switches support multi-chassis etherchannel).

 

This way you can lose one FortiGate and one of your D2 switches and still have connectivity.

 

gfleming_0-1675787056905.png

 

 

https://docs.fortinet.com/document/fortigate/7.0.0/best-practices/114990/high-availability-and-redun...

 

https://docs.fortinet.com/document/fortigate/7.0.9/administration-guide/62403/fgcp

 

https://docs.fortinet.com/document/fortigate/7.0.9/administration-guide/900885/ha-active-passive-clu...

Cheers,
Graham
Minx
New Contributor

Yes, will do that since we have to change to new FG

Thanks,

minx

minxminx

I test using GNS3, using 2 Channel-group:

A0/1,B0/1 channel-group 1 mode active, connected to FGT1 (port 5,6)

A0/2,B0/1 channel-group 2 mode active, connected to FGT2 (port 5,6)

with lacp-ha-slave disable, following this https://docs.fortinet.com/document/fortigate/6.0.0/handbook/207052/ha-with-802-3ad-aggregate-interfa...

Look like it works properly.

My question now, since the present setup (see original drawing) D1 connected to FGT port1, how do I create the new aggregate port with the same subnet and vlan?

And what is the best method to transfer all of the rules to the new Aggregate Port with minimum down time? 

gfleming
minxminx
New Contributor

I'm running 6.2.12, so there is no option for migrate.

I tried with 7.0.9 on GNS3:

1. Create AggPort and assigned different subnet

2. Backup

3. Remove configuration from port1, copy the ip address to AggPort (i tried to put on the first line after system configuration and just before VLAN)

4. Change all Sort/Dest /Reference that has port1 to AggPort

5. Restore

6. Verify rules are correct 

When I tried on the live (6.2.12), all IPv4 Policy from/to port1 are gone, the other port that I didn't touch and Vlan rules are still there.

I called support and he verified on his machine  that we couldn't do it that way.

Labels
Top Kudoed Authors