LLDP - Displayed Information

[bds38]

Hello!

I have enabled LLDP between a FortiGate 600D and one of my Cisco switches. Using show lldp neighbor on the Cisco switch displays some pretty useful information: 

Device ID           Local Intf     Hold-time  Capability      Port ID FGT61E4Q16001015    Gi6/0/43       117        R               wan1

As you can see from the information, the Cisco switch knows it is connected to wan1 through port Gi6/0/43. I can also run other commands to get more detail.

However, the FortiGate side shows quite a bit of information in the User and Device -> Device inventory section but nothing particularly useful. I can see the device name, the MAC, operating system etc but I cannot find any information about which ports are in use (which is really what I am after).

Does anyone know of a way to display this information or a CLI command that shows it? I couldn't find anything after quite a bit of digging.

[emnoc]

Did you try any of the lldp dump commands

cli-cmds

diag switch-controller  dump lldp neighbors-summary

diag switch-controller  dump lldp neighbors-detail

ken

[bds38]

Hi Emnoc,

Thanks for the reply - I can't get those CLI commands to work. 

I can get as far as diag switch-controller  dump but lldp isn't an option. Instead I get:

fw-test (root) # diag switch-controller dump?

vlan_config         configured switch-controller vlan info switch_config          configured managed-switch info mac_hosts          cached kernel mac hosts mac_hosts_switch_port          Display FortiSwitch port of detected devices device_access_list          cached device access list client          running clients port-stats          Managed FortiSwitch port statistics. trunk-state          Managed FortiSwitch trunk status. mac-addr          Managed FortiSwitch MAC address list.

[tsilvey]

I believe that the LLDP portion of this command was added in 6.x as I see it on my 6.x devices but not my 5.x devices.

[Wayne186]

There is a way that you can discover what ports are connected to a cisco device but the cisco device itself must be participating in LLDP. 

This is how I configured a port on a 3460 switch:

Test_Lab(config)#lldp run

Test_Lab(config)#end

Test_Lab#conf t

Test_Lab(config)#int f 0/11

Test_Lab(config-if)#lldp transmit

Test_Lab(config-if)#lldp receive

Test_Lab(config-if)#end

So now the Cisco device will send and receive lldp.

On the Cisco device you can run a nice and simple command:

Test_Lab#show lldp neighbors

This will show you a nice table:

Test_Lab#show lldp neighbors

Capability codes:

    (R) Router, (B) Bridge, (T) Telephone, (C) DOCSIS Cable Device

    (W) WLAN Access Point, (P) Repeater, (S) Station, (O) Other

Device ID           Local Intf     Hold-time  Capability      Port ID

FG100D3G1XXXXXX    Fa0/11         120        R               wan1

FG100D3G1XXXXXX    Fa0/24         120        R               port3

FG100D3G1XXXXXX    Fa0/22         120        R               port1

FG100D3G1XXXXXX    Fa0/23         120        R               port2

Total entries displayed: 4

For the Fortigate device it requires a little more leg work.  Typically all of your physical interfaces are in the management vdom and this is where you would run the command.  If you have no vdom's then don't worry about this, but if you do then just make sure you are in the vdom that hosts the physical interface that you are looking for.  Run this command:

diag sniff pack any 'ether proto 0x88cc' 4 (Note that 0x88cc is the LLDP protocol number so you will see all LLDP traffic inbound and outbound.. you are looking for the 'in' traffic.  The 'out' traffic is whatr the fortigate is sending out and that is how the cisco device builds its table)

The output you get will be something like this:

FG100D3G1XXXXXXX (root) # diag sniff pack any 'ether proto 0x88cc' 4

interfaces=[any]

filters=[ether proto 0x88cc]

6.839373 wan1 in lldp 286 chassis 4 00:1d:45:40:XX:XX port 7 'Fa0/11' ttl 120 system 'Test_Lab.cisco.com'

14.529373 port2 in lldp 290 chassis 4 00:1d:45:40:XX:XX port 7 'Fa0/23' ttl 120 system 'Test_Lab.cisco.com'

21.159373 port1 in lldp 290 chassis 4 00:1d:45:40:XX:XX port 7 'Fa0/22' ttl 120 system 'Test_Lab.cisco.com'

This is the cisco device telling us (let's use line the first line (6.839373) as an example) that my wan1 port is connected to Test_Lab.cisco.com on interface Fa0/11

I hope this helps