Multiple VLAN Trunking causing 100% CPU spike on 60E

[iamabes]

I'm hoping someone will be able to offer me some advice please, I have an issue configuring VLAN trunking, which when I enable the config I think should work, the CPU runs up to 100% on my Fortigate 60E and the device becomes unresponsive.

Very Basic topology looks like this:

Wired Users --> Zyxel GS1900-48HP --> Fortigate 60E --> Internet

Wireless Users connect first to a Cisco WAP121, which is connected to the Zyxel switch above.

Current setup (Fortigate 60E):

I have created a Hardware Switch called 'Inter-VLAN' in the Network | Interfaces section, and added interfaces 2 to 7 as members. 

I then created six VLAN sub-interfaces under the 'Inter-VLAN' switch, with VLAN IDs 20, 30, 40, 50, 60, and 70.  Each with it's own subnet, DHCP server, and DNS server.

Current setup (Zyxel GS1900-48HP):

Access ports are configured with the appropriate PVIDs, and are marked as 'un-tagged' on the appropriate VLAN ID.

Port 11 is configured as a Trunk, has a PVID of 1, is un-tagged for VLAN1, and tagged for VLANs 20, 30, 40, 50, 60 and 70.

Port 11 connects to interface 2 on the Fortigate 60E.

The current setup described above works, all end points are receiving their appropriate addresses from their respective DHCP servers, and are connecting through the SD-WAN to the internet correctly, all IPv4 policies are working as they should.

The problem occurs when I try to balance out the load of traffic from the Zyxel to the Fortigate by configuring additional trunk ports.  For example, if I configure port 13 on the Zyxel in the exact same way as port 11 (the current trunk), and connect to port 3 on the Fortigate, everything stops working.  The fortigate becomes unresponsive almost immediately, no internet access, and I can't access the Zyxel switch either.

I have tried many combinations of PVID assignment, VLAN tagging, and it seems no matter what I try, I keep getting the same result.  

Does anyone have any thoughts , questions or suggestions?

Thank you for your patience on this, I am migrating to this solution having previously used a Cisco 897VA (which incidentally had one VLAN assigned per physical port, and the Zyxel connected to it with dedicated trunk ports each tagged for a single VLAN).

[bmduncan34 · Accepted solution]

I'll bet you've introduced a loop in your network.  I've seen that in my own environment and cpu on the gate going to 100% is one indicator of that.  Are you certain you aren't introducing a spanning tree problem with port 13?

[ede_pfau · Accepted solution]

where to start...welcome to the forums!

Your original setup shortened VLAN 1 (at least) which was connected to both switch ports and at the same time to 2 FGT switch ports. IMHO, configuring a hardware switch was not favorable in the first place. But you've found that out by yourself, great.

So, the way to go is:

- create an LACP port group ("LAG") on the switch. Allow your VLANs on this (virtual) port.

- create an LACP port on the FGT, using at least 1 port (you may add more ports later, even while running). Say, it's called "trunk".

- pull your config, no encryption.

- you'll see in section "config system interface" the the VLAN ports carry a line which specifies the physical port this VLAN is attached to (example given):

    edit "tel"
        set vdom "root"
        set ip 172.16.236.1 255.255.255.0
        set allowaccess ping
        set description "20180808 for VoIP devices"
        set role lan
        set interface "internal7"   <== this is the physical port
        set vlanid 6

    next

and

config system dhcp server
    edit 1
        set lease-time 10800
        set default-gateway 192.168.234.1
        set netmask 255.255.255.0
        set interface "internal7"   <== this is the physical port
...

All you need to do now is to change that port (here: "internal7") to the LACP port, i.e. "trunk".

It may help if you search for the hw switch port name and change all occurrences EXCEPT FOR the port definition itself.

- restore this config, the FGT will reboot

- plug the cables from the FGT hw switch ports to the Zyxel switch LAG ports

- test

You may now pull all member ports from the hw switch port, and delete it after removing all references (DHCP servers, DNS, NTP, policies, routes, whatever).

[iamabes]

Team,

Very happy to report that all is working as required now.

@Ede - thank you for your guidance.  Thanks also to the others who left comments, they all helped me troubleshoot and get to a working solution.

I repeated the procedure I outlined above for backing up, editing and restoring the config, but with the difference that I moved the definition of the aggregated port above the VLANs.

The FGT rebooted, all VLANs were present and correct as sub-interfaces of AggInt01, all policies, DHCP servers, IP reservations, and DNS servers remained intact and are functioning correctly.

Marking this thread as 'answered'.