Trunk and native VLAN between Juniper EX and FortiSwitch

[Taner91xp]

Hello All, I have connection problem with Juniper EX2300-48T with firmwate Junos: 18.1R3.3 and FortiSwitch 108F-POE with firmware S108FP-v7.2.3-build434,221212 (GA).On Juniper the configuration of the port is: native-vlan-id 10, interface-mode trunk, vlan members 20, vlan members all.
I tried also removing the last line with vlan members all but without any change.The switching is work on the trunk with allowed vlans but  the native vlan 10 doesn't work.

[Taner91xp]

Hi, no there is no any devace that can make loop or broadcast storm.
This is the output of the requested command:

FortiSW # diagnose stp instance list 0

MST Instance Information, primary-Channel:

Instance ID 0 (CST)
Config Priority 32768
Bridge MAC 94ff3c1e537a, MD5 Digest 9999b43d77cc58bba8854f9991c 4a487

Root MAC 0024136bd700, Priority 4097, Path Cost 20000, Remaining Hop s 19

Regional Root MAC 94f392f50326, Priority 32768, Path Cost 20000, Root Port __ FoRtILnk0L3__

Active Times Forward Time 15, Max Age 20, Remaining Hops 19

TCN Events Triggered 4 (0d 18h 12m 10s ago), Received 111 (0d 0h 14m 34s a go)

Port Speed Cost Priority Role State Hel loTime Flags
________________ ______ _________ _________ ___________ __________ ___ ______ _______________

port1 100M 200000 128 DESIGNATED FORWARDING 2 EN ED
port2 - 200000000 128 DISABLED DISCARDING 2 ED
port3 100M 200000 128 DESIGNATED FORWARDING 2 EN ED
port4 - 200000000 128 DISABLED DISCARDING 2 ED
port5 1G 20000 128 DESIGNATED FORWARDING 2 EN ED
port6 - 200000000 128 DISABLED DISCARDING 2 ED
port7 10M 2000000 128 DESIGNATED FORWARDING 2 EN ED
port9 - 200000000 128 DISABLED DISCARDING 2 ED
port10 - 200000000 128 DISABLED DISCARDING 2 ED
internal 1G 20000 128 DESIGNATED FORWARDING 2 ED
__FoRtILnk0L3__ 1G 20000 128 ROOT FORWARDING 2 EN

Flags: EN(STP enable), ED(Edge), LP(Loop Protection Triggered)
RG(Root Guard Triggered), BG(BPDU Guard Triggered), IC(PVST Port Inconsistent)
MV(PVST Port Vlan Mismatch)

This is the output of Junper EX before the FortiSwitch:

Juniper-EX> show spanning-tree ?
Possible completions:
bridge Show STP bridge parameters
interface Show STP interface parameters
mstp Show Multiple Spanning Tree Protocol information
statistics Show STP statistics
stp-buffer Internal buffer for STP
{master:0}
Juniper-EX> show spanning-tree bridge
STP bridge parameters
Routing instance name : GLOBAL
Context ID : 0
Enabled protocol : RSTP
Root ID : 32768.f0:4b:3a:79:bc:29
Hello time : 2 seconds
Maximum age : 20 seconds
Forward delay : 15 seconds
Message age : 0
Number of topology changes : 57
Time since last topology change : 65954 seconds
Local parameters
Bridge ID : 32768.f0:4b:3a:79:bc:29
Extended system ID : 0

{master:0}


This is the output from the core:

CoreQFX> show spanning-tree bridge
STP bridge parameters
Routing instance name : GLOBAL
Enabled protocol : RSTP

STP bridge parameters for VLAN 900
Root ID : 900.7c:25:86:6b:10:b0
Hello time : 2 seconds
Maximum age : 20 seconds
Forward delay : 15 seconds
Message age : 0
Number of topology changes : 371
Time since last topology change : 492333 seconds
Local parameters
Bridge ID : 2.7c:25:86:6b:10:b0
Extended system ID : 900

On FortiSwitch:
Fortisw # show switch stp instance
config switch stp instance
edit "0"
config stp-port
edit "port1"
next
edit "port2"
next
edit "port3"
next
edit "port4"
next
edit "port5"
next
edit "port6"
next
edit "port7"
next
edit "port9"
next
edit "port10"
next
edit "internal"
next
edit "__FoRtILnk0L3__"
next
end
next
edit "15"
config stp-port
edit "internal"
next
edit "__FoRtILnk0L3__"
next
end
set vlan-range 4094
next
end

[Taner91xp]

My colleagues noticed that the QFX core switch with VSTP and Juniper EX with RSTP  don't talk STP each other.
QFX is the root for himself, all Juniper EX are root for themselves, Cisco switches are with rapid-pvst and with different STP priority and for this reason not become root when they are behind Juniper EX, and for all Cisco switches the root is Juniper QFX.

When we connect Forti, The Forti transparantly talks mstp with rapid-pvst with CIsco switches, and the root for Forti is the Cisco switch.

The question is how to configure all devices to work correctly and achieve correct STP topology?

[Dan_Eng52]

Hi Taner91xp, 

FortiSwitch runs MSTP and can interoperate with RPVST+ however, this requires some work i.e. enabling set rpvst-port enabled on the interface connecting to the Cisco device. A maximum of 16 VLAN's are supported (Including native VLAN) and you must configure the same VLANs as those used in the RPVST+ domain. Having experience in this, it isn't worth it and deploying MSTP on the Cisco devices is a better option. 

It's recommended that you enable both VSTP and RSTP on the EX series and QFX series interface when interoperating with PVST+ and RPVST+ but from what I am hearing, I would suggest that you redesign your spanning-tree.

Since FortiSwitch runs MSTP and this is supported by the rest of your environment, I suggest that you plan to roll-out MSTP for QFX core, Juniper EX and Cisco. This will allow you to design your spanning-tree properly and have full L2 convergence with all devices speaking a language they can understand. 

You could put a plaster over it and get in functional perhaps but having different spanning-tree versions, with different vendor switches acting as root bridge is a recipe for disaster in my eyes. If your QFX is the core make this the root of your network and ensure all other devices outside of this know that and converge correctly. 

[Taner91xp]

Hi, Thank you for the detailed explanation.

My colleague did find this as a solution during replacing all Cisco devices witch FortiSwitches.
And in the end we will configure MSTP between QFX/EX and FortiSwitch.

When  we connect  Forti to Juniper, on Juniper side we do this configuration:
If it's trunk link we apply this:
set protocols layer2-control bpdu-block interface ge-0/0/21 drop
If it's lacp we apply this:
set protocols layer2-control bpdu-block interface ae1 drop
And this solves STP issues.