I have an FGT-61F (FortiOS 6.4.4) connected on Port A to a FortiSwitch ISL Ring (4 Units of 148F). So far all looks good.
The FGT-61F comes out of the box with two predefined dedicated as FortiLink interfaces (A,B).
I would like to setup a Standby Fortilink connection to another switch in the current ISL ring and wanted to use port B for that. Similar to the configuration described here: https://docs.fortinet.com/document/fortiswitch/6.4.2/devices-managed-by-fortios/617516/network-topol... (Single FortiGate unit managing a stack of several FortiSwitch units).
However, A+B are setup as hardware switch. I can therefore not apply "set fortilink-split-interface enable" as Standby only works with aggregate interfaces.
The out-of-the-box FortiLink interface represents like this:
config system interface
edit "fortilink"
set vdom "root"
set fortilink enable
set ip 169.254.1.1 255.255.255.0
set allowaccess ping fabric
set type hard-switch
set snmp-index 7
set auto-auth-extension-device enable
set switch-controller-nac "fortilink"
set swc-first-create 127
next
end
Since the current FortiLink interface has many dependencies and I'd like to stay as much as possible with the pre-configured setting, it is not a simple task (at least for me) to change this interface into an aggregate interface which would then allow to enable split-interface.
Is there a way to change that current fortilink interface in a way that I can connect port B to another switch and get a standby connection? Would you be able to show me step by step on how to do this? I would really appreciate your help.
I might want, to a later time, turn the main connection into an MCLAG, but for the time being I'm just interested in a Standby FortiLink as shown in the picture.
Thanks for any hint.
Daniel
Information sources consulted so far:
[ul]Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Just get in CLI, then "show | grep -f fortilink" so you can see all references you need to remove before removing the fortilink hard-switch. That's how I did to separate "a" port on FG40F. I don't remember exactly but DHCP server, and NTP server (needed to disable ntpsync) etc. config was using it.
Hello Toshi,
I had to delete the VLANS and the already authenticated FortiSwitches as well.
But the VLAN's were recreated and the switches did come back too.
Unfortunately I only realized later that the 148 Switches I use do not support MCLAG. What a shame...
Anyway, the Standby FortiLink is working now. Fortigate port A is connected to one switch (Active) and Fortigate port B is connected to another switch (standby). I physically disconnected A and checked that B became active.
One thing puzzles me a bit. Shortly after the change from A to B, I will see both connections from the FortiGate to the two switches as dotted lines in the FortiLink topology view. After a while, one line gets solid, as expected.
But after yet another few minutes, the dotted line (the standby link) just disappears. I would have expected that the standby connection would stay visible as dotted line.
I can also not see that (lost) cable connection in the ports view. Although the cable still is connected, both ends are inactive. For the ports view in the Fortigate, those two ports are just inactive as if there was no cable connection.
The logfile on the switch reports
FortiLink: disabled port port44 port-id=44 from b(1) fwd(1)
FortiLink: removed port port44 port-id=44
Is that a bug of the GUI?
Daniel
You can also take a backup of the current FortiGate, then in under sys interface change type to Agg.
Old config
config sys inter
....
edit fortilink
...
set type hard-switch
...
next
end
Change the "hard-switch" to "aggregate" and leave the Members alone. Then upload the new config to the firewall, it reboots and now you have an aggregate. I have used this to move a Fortilink connection from a single link to an Aggregate in the past. Mike
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1688 | |
1087 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.