Initial questions on FortiGate control of multiple FortiSwitches

[tanr]

Hi All,

I'll be doing some quick proof on concept work next week with a 5.4.6 FortiGate controlling a couple 3.6.3 108D-POE FortiSwitches. This is mostly to see if larger FortiSwithces might work for a different location.

I've run through the documentation, but have some questions before I get started, most of them basically boiling down to: Is there any way to manage FortiSwitches from the FortiGate but do it through distinct (not hardware/software switch) interfaces?

[ol]

Even with multiple FortiSwitches, all examples show a SINGLE FortiLink interface (which could be a hardware or software within the FortiGate spanning multiple physical ports) connecting to the switches (which may have ISL between them).  See http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-managing-fortiswitch-330-54/Stacking.... examples.  This is required?  I can't have two SEPARATE FortiLink interfaces to further separate the switches?  Even if I set fortilink-stacking disable?

Related to #1, the only way shown to create VLANs for the managed FortiSwithches shows the VLAN interfaces being created on the (single) FortiLink interface as in http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-managing-fortiswitch-330-54/VLANconfi....  Thus all VLANs get trunked through the FortiLink.  No way to have VLANs on other FortiGate interfaces if I want to manage those VLANs on the FortiSwitch?  Why not?

All the examples I've found show the FortiGate only connecting to FortiSwitch(es) through a FortiLink connection.  Can the switch also have connections to other FortiGate interfaces?  How about to non-FortiLink VLAN interfaces on the FortiGate?[/ol]

As you can probably tell, most of this is trying to figure out a way to manage a FortiSwitch from the FortiGate but still keep its VLANs and other interfaces as separated as possible.  This is to make it harder to accidentally break security with a single error, like the incorrect vlan being set on a switch interface.  One use case is for a bunch of IP security cameras on a single switch.  Really don't want to plug that back into our lan!

[tanr]

Still haven't found a way to have separate physical interfaces on the FortiGate for separate VLANs unless I use VDOMs or unless I don't have the FortiGate manage the FortiSwitch.

Anybody else?

[Prab]

Hi Tanr,

Regarding the Question1:

A fortiGate can only have one fortiLink at the moment. This fortiLink can be a single interface or a logical interface (software switch or 802.3ad aggregate interface etc.) In case you plan to use a logical link, make sure you understand the limitations of the logical links.

Regarding Question2:

This is true and this is by design. You can still create VLANs on FortiGate too, but yes it looks bit messy.

Regarding Question3:

Long story short please do not do this. It might work (I tested it in my Lab and it worked), but it is not a supported topology, so at the end of the day FortiNet Support has right to tell you to run off, in case you open a support ticket for any topology that is officially not supported by the FortiGate/FortiLink/FortiSwitch. for Example: The following topology worked in my lab fine, but as per FortiNet support this is not supported officially. ;)

Hope this was helpful.

Thanks & regards,

Prab

[tanr]

Hi Prab,

Thanks for the info.  The picture helps explain your "non-supported" config nicely.  What you said matches most of what I've worked out so far. 

One additional question I haven't found an answer to yet (I have the question open with TAC) is if there is a good way to have CLI access to the FortiSwitches, not just have them managed by the FortiGate.  The switch-controller custom-commands are not sufficient for our needs.

I have seen descriptions of how to set this up with a managed FortiSwitch if it has a dedicated management port. See https://docs.fortinet.com/uploaded/files/2742/manageFSWfromFGT54.pdf "Configuring FortiSwitch Management Port" for details. However I can't seem to get this to work for my 108D-POEs, which have no management port. 

Any suggestions on how to get/keep CLI access to the FortiSwitches after they are managed by the FortiGate?

[Prab]

tanr wrote:

Hi Prab,

Thanks for the info.  The picture helps explain your "non-supported" config nicely.  What you said matches most of what I've worked out so far. 

One additional question I haven't found an answer to yet (I have the question open with TAC) is if there is a good way to have CLI access to the FortiSwitches, not just have them managed by the FortiGate.  The switch-controller custom-commands are not sufficient for our needs.

I have seen descriptions of how to set this up with a managed FortiSwitch if it has a dedicated management port. See https://docs.fortinet.com/uploaded/files/2742/manageFSWfromFGT54.pdf "Configuring FortiSwitch Management Port" for details. However I can't seem to get this to work for my 108D-POEs, which have no management port. 

Any suggestions on how to get/keep CLI access to the FortiSwitches after they are managed by the FortiGate?

Hi Tanr,

If the fortiSwitch is being managed by a FortiGate, then it is a generally a bad idea to manage them directly (eg: via SSH, HTTPS etc). Please only make changes to the managed fortiSwitches from the FortiGate. This is because there can be a mismatch between the configurations running on the fortiSwitch and configuration of the fortiSwitch running on the FGT.

Also once the the fortiSwitch is managed via FortiGate (at least FortiOS 5.6.3 & FortiSwitch OS 3.6.3), you can directly establish a CLI connection to the fortiSwitch from the FortiGate. However unfortunately I am not sure if this CLI access can execute all the commands, that you mentioned. For me, I was able to configure everything from the FortiGate on the managed fortiSwitch and never needed to log in directly to the fortiSwitch. Do you have a special case or a reason?

Maybe the FortiNet support can provide some details here?

Thanks & regards,

Prab :)

[tanr]

I can understand concerns about CLI access when the FortiSwitch is managed by the FortiGate.  But how to access the CLI directly (if the FortiSwitch has a management port) is in the documentation, plus multiple places where the documentation says to make a CLI change to the FortiSwitch along with a change from the FortiGate.  Hey, what could go wrong?  ;->

I've got 3 needs for the FortiSwitch CLI currently:

[ul]

Change the DNS servers it uses (change through custom-command hasn't worked)

Change the NTP server it uses (change through custom-command hasn't worked)

Display config and diagnostic info from the FortiSwitch (show, get, diag debug, etc.) - again, don't get output when using custom-command[/ul]

I'm sure I'll have other CLI needs in the future.  With the larger switches I can just use the management port or the serial port for this.  It's just the little 108D-POE that doesn't have one or the other.

[Prab]

tanr wrote:

I can understand concerns about CLI access when the FortiSwitch is managed by the FortiGate.  But how to access the CLI directly (if the FortiSwitch has a management port) is in the documentation, plus multiple places where the documentation says to make a CLI change to the FortiSwitch along with a change from the FortiGate.  Hey, what could go wrong?  ;->

I've got 3 needs for the FortiSwitch CLI currently:

[ul]

Change the DNS servers it uses (change through custom-command hasn't worked)

Change the NTP server it uses (change through custom-command hasn't worked)

Display config and diagnostic info from the FortiSwitch (show, get, diag debug, etc.) - again, don't get output when using custom-command[/ul]

I'm sure I'll have other CLI needs in the future.  With the larger switches I can just use the management port or the serial port for this.  It's just the little 108D-POE that doesn't have one or the other.

Hi Tanr,

I just tested to change the DNS settings of the managed fortiSwitch via the CLI access from the FGT & it works.

I am using 5.6.3 FortiOS and 3.6.3 FortiSwitchOS. Also, there are some commands that you can directly execute from the FGT's CLI for eg: diagnose switch-controller dump stp & for some commands you have to establish a CLI access from the FGT GUI to the corresponding fortiSwitch.

Hope it was helpful.

Thanks & regards,

Prab :)

[tanr]

Thanks for the info Prab.

I've been able to make the changes I needed by running "exec ssh" on the FortiGate to directly manage the switch.  I've also finally been able to access the switch remotely for management from one of our subnets, but only after deauthorizing it, doing a factory reset, and reauthorizing it.  Don't know what that cleared up, but I'm happy to have it work.

Still have an issue related to this that I'm working on with TAC.  Will try to post here once resolved, if possible.