Hi!
I have issue with 1G connection between switch to fortigate that the traffic is almost hitting the top.
I am thinking about somehow creating LACP to use two ports or three to increase the link speed between the switch and Fortigate.
I have some mixture of ideas going through my mind but if someone can suggest the best way to do it.
Please see the attached network pic.
Thanks
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
hi,
there is a link missing between the passive cluster member and VLAN 200.
You can create a LACP port (aggregate) on the FGT cluster and use it instead of the 'internal' port you use now. FortiOS uses a fast LACP mode, that is, sends hello packets (BPDUs) every 2 seconds. Some switches (like Cisco) use slow LACP per default. You can change that either on the FGT or the Cisco side.
Note that you will see higher throughput only if the traffic consists of many sessions. One session with a TB transfer will still be limited to 1 Gbps. That is the nature of LACP aggregates.
Thanks Ede
The link is there for passive cluster member and I didnt mention it :).
What type of LACP you are proposing? Layer 2 or 3.
Thanks
Hi,
Fortigate will use a Layer 4 algorythm for LACP.
On the switch side you will have to use Layer 3 or 4 (if the switch supports it). Layer 2 LACP with a router on the other side will still limit your traffic to 1GBit...
Br,
Roman
Hi!
I have layer 2 switch. The link between switch and core router is 20 GB. I am running lacp between then and one physical link is 10G.
Is it not possible to use layer 2 lacp and then create a VLAN on that with vlan 200 and Assign IP address 192.168.1.2?
Thanks
Hi,
sure it is possible. But with layer 2 LACP on the switch side the Switch will only use 1 link on the aggregate between the Fortigate and the Switch for the traffic which is routed on the layer 3 switch.
Br,Roman
Thanks Roman.
Is the concept of aggregate is different on fortigate? The normally concept of of port-channel/link aggregation/Bridge aggregation is that it will utilizes both port for different sessions.
Hey,
you are right about DIFFERENT SESSIONs. To avoid out of order delivery LACP will use a hashing mechanism to keep traffic from a source/destination combination always on the same link:
For LACP configurations with layer 2 traffic distribution, egress traffic from MAC Address A to MAC address B will always use the same link. So routed traffic to the firewall will always stay on the same GBit link.
For LACP configurations with layer 3 traffic distribution, egress traffic from IP A to IP B will always use the same line. Therefore routed traffic will be distributed over the members of the aggregate. This is what you should configure on your LACP aggregate on the switch side.
For LACP configurations with layer 4 traffic distribution, the combination of IP and Port information will be used to distribute the traffic egressing the channel... This is what a Fortigate does be default and higher end switches can do.
Br,
Roman
ok thanks.
The issue is in my case I have VLAN. I dont want to change the network topology in quick session and the only way for me in the time being is to work with link between switch to fortigate.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.