LACP configuration FGT and cisco switch

[Umesh]

Hi All,

I have doubt regarding LACP configuration in fortigate Firewall along with cisco switch, Can anybody explain it how can we implement it real environment.

Please find the attached snapshot where you can see what I want to design in our environment.

Thank you.

[ede_pfau]

I think the missing element in this setup is the ISL between SW1 and SW2. If both switches were stacked one would immediately see that both LACP trunks would be operating with 2 ports each.

If one switch fails, the trunk from the active FGT would halfe in bandwidth but continue to work. If you need the complete bandwidth at all times, monitor those links to trigger a HA failover if one link fails.

[ede_pfau]

Again: LACP trunks to 2 separate switches will not work. The solution is to stack these switches.

Can you do this? Are there sufficient ports free for a link? Does your model and firmware support this?

If not, you'd need to go with just one switch. Which, BTW, is not so uncommon, switches are much more resilient/reliable than devices with higher level functions like firewalls.

[gfleming]

Yeah this won't work unless those two Cisco switches are either stacked together or using VPC. You can't establish a LAG split between two different independent switches.

What model Cisco switches are they?

[Umesh]

Hi Graham,

I would like to tell you that switch 1 and switch 2 are the normal L2 cisco switch, in this case can it work or not.

Case 1 - If Sw 1 goes down, traffic should move via sw2

[jnielsen]

As Graham said, you can not make a LAG between two independent L2 switches. You must either stack them (e.g. Catalyst stack-ring) or make a VPC (Cisco Nexus). If you only have two stand-alone L2 switches, the best you could do would be something like this:


This will give you some link redundancy and aggregation, but in case of e.g. the switch of the active firewall goes down/is rebooted, it will trigger a HA-failover. 

[Umesh]

thank you for providing the solution

[Umesh]

They are basically L2 catalyst switches. 

[Mohamed_Gaber]

You have to link the two switches to prevent loops in the network and have a path for the traffic that reaches one and needs to go through the other.

If you configure LACP on FortiGate you have to consider a point. Don't put the ports of both FortiGate units in one LACP group on the switch. You should add them to two different groups. If you do the setup as your design, FortiGate will detect different switches on the ports, and one of the ports will work and the other will not. But we have two FortiGate. will they both choose the same switch or the master will do it? I am not sure. If the two units activate the link on different switches STP should disable one.

[Yurisk]

For completeness sake - yes, as others have said, you CANNOT create an aggregate trunk to 2 separate Cisco switches WITH LACP (you would get an error on FGT side "mismatch aggregate ID" of a sort and one aggregate would not form) . On the other hand, you can create an aggregate if you disable LACP altogether, and form the aggregate statically. I can't vouch how good will it be, or will it work as expected, but aggregate will come up.  I had to do it (unfortunately) in specific circumstances and it worked - Fortigate to 2 Cisco switches w/o LACP.

If you feel adventurous, try doing LACP with debug enabled on FGT Fortigate LACP debug commands