Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
capricorn80
New Contributor II

Maximize the uplink port speed on Fortigate 100E

Hi!

 

I have issue with 1G connection between switch to fortigate that the traffic is almost hitting the top.

I am thinking about somehow creating LACP to use two ports or three to increase the link speed between the switch and Fortigate.

I have some mixture of ideas going through my mind but if someone can suggest the best way to do it. 

Please see the attached network pic.

 

Thanks

8 REPLIES 8
ede_pfau
Esteemed Contributor III

hi,

 

there is a link missing between the passive cluster member and VLAN 200.

 

You can create a LACP port (aggregate) on the FGT cluster and use it instead of the 'internal' port you use now. FortiOS uses a fast LACP mode, that is, sends hello packets (BPDUs) every 2 seconds. Some switches (like Cisco) use slow LACP per default. You can change that either on the FGT or the Cisco side.

 

Note that you will see higher throughput only if the traffic consists of many sessions. One session with a TB transfer will still be limited to 1 Gbps. That is the nature of LACP aggregates.


Ede

"Kernel panic: Aiee, killing interrupt handler!"
Ede"Kernel panic: Aiee, killing interrupt handler!"
capricorn80

Thanks Ede

 

The link is there for passive cluster member and I didnt mention it :).

What type of LACP you are proposing? Layer 2 or 3.

 

Thanks

 

romanr
Valued Contributor

Hi,

 

Fortigate will use a Layer 4 algorythm for LACP.

 

On the switch side you will have to use Layer 3 or 4 (if the switch supports it). Layer 2 LACP with a router on the other side will still limit your traffic to 1GBit...

 

Br,

Roman

capricorn80
New Contributor II

Hi!

 

I have layer 2 switch. The link between switch and core router is 20 GB. I am running lacp between then and one physical link is 10G.

 

Is it not possible to use layer 2 lacp and then create a VLAN on that with vlan 200 and Assign IP address 192.168.1.2?

 

Thanks

romanr
Valued Contributor

Hi,

 

sure it is possible. But with layer 2 LACP on the switch side the Switch will only use 1 link on the aggregate between the Fortigate and the Switch for the traffic which is routed on the layer 3 switch.

 

Br,Roman

capricorn80
New Contributor II

Thanks Roman.

 

Is the concept of aggregate is different on fortigate? The normally concept of of port-channel/link aggregation/Bridge aggregation is that it will utilizes both port for different sessions.

romanr
Valued Contributor

Hey,

 

you are right about DIFFERENT SESSIONs. To avoid out of order delivery LACP will use a hashing mechanism to keep traffic from a source/destination combination always on the same link:

 

For LACP configurations with layer 2 traffic distribution, egress traffic from MAC Address A to MAC address B will always use the same link. So routed traffic to the firewall will always stay on the same GBit link.

For LACP configurations with layer 3 traffic distribution, egress traffic from IP A to IP B will always use the same line. Therefore routed traffic will be distributed over the members of the aggregate. This is what you should configure on your LACP aggregate on the switch side.

For LACP configurations with layer 4 traffic distribution, the combination of IP and Port information will be used to distribute the traffic egressing the channel... This is what a Fortigate does be default and higher end switches can do.

 

Br,

Roman

capricorn80
New Contributor II

ok thanks. 

 

The issue is in my case I have VLAN. I dont want to change the network topology in quick session and the only way for me in the time being is to work with link between switch to fortigate.

Top Kudoed Authors