Hello all. We have a FortiGate 200D (IP 10.10.0.2) connected to an Ubiquiti EdgeSwitch (IP 10.10.0.5). We want to connect both devices with Link Aggregation (LAG) for tagged VLANs, but it is not working. According to various documentation we found online, we created a new interface as "802.3ad Aggregate" with ports 15 and 16 and no IP. And the ports show up with an established LACP state, ASAIEE partner state and matching IDs (see config and details below). And with diag cmd, we see LACPDU packets from the switch. But we cannot ping or communicate with the other side by IP. We have also tried changing lacp-mode to static (on both ends) or passive on the FG, enabling (in various combinations) broadcast-forward, l2forward, stpforward, and/or vlanforward on the LAG, put the LAG in a new zone, tried to add the LAG to the lan interface but that option is not available, and finally add LAG<->LAN policies ... all with no change to IP connectivity. In case it matters, the FG is not in transparent mode and not using multi-domain. LAG between two EdgeSwitches works. We saw one forum post that looked like another user had LAG working when they were in a multi-domain configuration, but we could not find anything to confirm that configuration was required. Can anyone please confirm if we must use a multi-domain configuration and/or provide the configuration for LAG to work in a root-only domain.
Thank you. - - - Config Section - - - # show system interface lag-test config system interface edit "lag-test" set vdom "root" set allowaccess ping set type aggregate set member "port15" "port16" set lacp-mode active set role lan set snmp-index 10 next end # diag netlink aggregate name lag-test ... slave: port15 link status: up LACP state: established actor state: ASAIEE actor port number/key/priority: 1 17 255 partner state: ASAIEE partner port number/key/priority: 23 66 128 aggregator ID: 1 speed/duplex: 1000 1 RX state: CURRENT 6 MUX state: COLLECTING_DISTRIBUTING 4 slave: port16 link status: up LACP state: established actor state: ASAIEE actor port number/key/priority: 2 17 255 partner state: ASAIEE partner port number/key/priority: 24 66 128 aggregator ID: 1 speed/duplex: 1000 1 RX state: CURRENT 6 MUX state: COLLECTING_DISTRIBUTING 4
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Try switching the LAG to static in the Fortigate, this is the only configuration I could use so far.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1714 | |
1093 | |
752 | |
447 | |
232 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.