Maximize the uplink port speed on Fortigate 100E

[capricorn80]

Hi!

I have issue with 1G connection between switch to fortigate that the traffic is almost hitting the top.

I am thinking about somehow creating LACP to use two ports or three to increase the link speed between the switch and Fortigate.

I have some mixture of ideas going through my mind but if someone can suggest the best way to do it. 

Please see the attached network pic.

Thanks

[ede_pfau]

hi,

there is a link missing between the passive cluster member and VLAN 200.

You can create a LACP port (aggregate) on the FGT cluster and use it instead of the 'internal' port you use now. FortiOS uses a fast LACP mode, that is, sends hello packets (BPDUs) every 2 seconds. Some switches (like Cisco) use slow LACP per default. You can change that either on the FGT or the Cisco side.

Note that you will see higher throughput only if the traffic consists of many sessions. One session with a TB transfer will still be limited to 1 Gbps. That is the nature of LACP aggregates.

[capricorn80]

Thanks Ede

The link is there for passive cluster member and I didnt mention it :).

What type of LACP you are proposing? Layer 2 or 3.

Thanks

[romanr]

Hi,

Fortigate will use a Layer 4 algorythm for LACP.

On the switch side you will have to use Layer 3 or 4 (if the switch supports it). Layer 2 LACP with a router on the other side will still limit your traffic to 1GBit...

Br,

Roman

[capricorn80]

Hi!

I have layer 2 switch. The link between switch and core router is 20 GB. I am running lacp between then and one physical link is 10G.

Is it not possible to use layer 2 lacp and then create a VLAN on that with vlan 200 and Assign IP address 192.168.1.2?

Thanks

[romanr]

Hi,

sure it is possible. But with layer 2 LACP on the switch side the Switch will only use 1 link on the aggregate between the Fortigate and the Switch for the traffic which is routed on the layer 3 switch.

Br,Roman

[capricorn80]

Thanks Roman.

Is the concept of aggregate is different on fortigate? The normally concept of of port-channel/link aggregation/Bridge aggregation is that it will utilizes both port for different sessions.

[romanr]

Hey,

you are right about DIFFERENT SESSIONs. To avoid out of order delivery LACP will use a hashing mechanism to keep traffic from a source/destination combination always on the same link:

For LACP configurations with layer 2 traffic distribution, egress traffic from MAC Address A to MAC address B will always use the same link. So routed traffic to the firewall will always stay on the same GBit link.

For LACP configurations with layer 3 traffic distribution, egress traffic from IP A to IP B will always use the same line. Therefore routed traffic will be distributed over the members of the aggregate. This is what you should configure on your LACP aggregate on the switch side.

For LACP configurations with layer 4 traffic distribution, the combination of IP and Port information will be used to distribute the traffic egressing the channel... This is what a Fortigate does be default and higher end switches can do.

Br,

Roman

[capricorn80]

ok thanks. 

The issue is in my case I have VLAN. I dont want to change the network topology in quick session and the only way for me in the time being is to work with link between switch to fortigate.