Unable to connect 92D on a Juniper switch - MAC learning issue

[seth57]

Hi all

i just bought a 92D to replace my 60D

I converted config file to match new hardware and connected it to Juniper switch but nothing worked

I searched what could be wrong on fortigate but all seems to be OK

On switch side, i saw that when internal1 was connected ( only this port connected to the switch ), MAC address was correctly learnt on the switch port but when internal2 was connected, MAC of internal1 disappeard from the switch and i could only see the MAC of internal2

At this instant, my 60D is working perfectly on this switch so i think that the problem does not come from the switch

are you aware about this kind of problem ?

Is there any parameter to set up ?

Thanks in advance

[emnoc · Accepted solution]

What's the cfg like for the access port and are you sure  your not mistaking   STP blocking or BPDU filters on the juniper?  And what's your topology and reason for connecting the 2 internals? And are you running these 2 ports in the same STP domain ? And do you have STP enable on the fortigate?

You can check via the EX cmds for port blocked by STP;

show spanning-tree interface terse

show ether-switch table

[seth57]

Hello

i had to deactivate STP on EX4200 to have the fortigate running

STP is not activated on FGT

[emnoc]

That's probably not a good ideal. If you ever get a layer2 loop, you will have a disastrous outcome.

Since the FGT60 was working, once again what did you have cfg configured on  the ports that are used? Are you connecting this as a switch interface to the EX?

[seth57]

Each FGT interface is connected to EX switch

Fortigate is in interface mode, so i guess that BPDUs are not forwarded from a vlan to another

I yes, i do not understand why and i don't know how to deactivate this

Interfaces config is the same as the 60D

I already encounter a storm ... but i need to replace 60D as licenses are over ...

[seth57]

please find full config of internal1 and 2 below

    edit "internal1"         set vdom "root"         set mode static         set dhcp-relay-service disable         set ip 192.168.102.254 255.255.255.192         set allowaccess ping https ssh         set fail-detect disable         set pptp-client disable         set arpforward enable         set broadcast-forward disable         set bfd global         set l2forward disable         set icmp-redirect enable         set vlanforward disable         set stpforward disable         set ips-sniffer-mode disable         set ident-accept disable         set ipmac disable         set subst disable         set status up         set netbios-forward disable         set wins-ip 0.0.0.0         set type physical         set netflow-sampler disable         set sflow-sampler disable         set sample-rate 2000         set polling-interval 20         set sample-direction both         set explicit-web-proxy disable         set explicit-ftp-proxy disable         set tcp-mss 0         set inbandwidth 0         set outbandwidth 0         set spillover-threshold 0         set weight 0         set external disable         set description ''         set alias "Private_VLAN"         set l2tp-client disable         set security-mode none         set device-identification enable         set device-user-identification enable         set device-access-list ''         set device-netscan disable         set lldp-transmission vdom         set listen-forticlient-connection disable         set vrrp-virtual-mac disable         set snmp-index 7         set secondary-IP disable             config ipv6                 set ip6-mode static                 unset ip6-allowaccess                 set ip6-reachable-time 0                 set ip6-retrans-time 0                 set ip6-hop-limit 0                 set ip6-address ::/0                 set ip6-send-adv disable                 set autoconf disable                 set dhcp6-relay-service disable             end         unset dhcp-relay-ip         set dhcp-relay-type regular         unset macaddr         set speed auto         set mtu-override disable         set wccp disable         set drop-overlapped-fragment disable         set drop-fragment disable     next     edit "internal2"         set vdom "root"         set mode static         set dhcp-relay-service disable         set ip 192.168.103.254 255.255.255.224         set allowaccess ping snmp         set fail-detect disable         set pptp-client disable         set arpforward enable         set broadcast-forward disable         set bfd global         set l2forward disable         set icmp-redirect enable         set vlanforward disable         set stpforward disable         set ips-sniffer-mode disable         set ident-accept disable         set ipmac disable         set subst disable         set status up         set netbios-forward disable         set wins-ip 0.0.0.0         set type physical         set netflow-sampler disable         set sflow-sampler disable         set sample-rate 2000         set polling-interval 20         set sample-direction both         set explicit-web-proxy disable         set explicit-ftp-proxy disable         set tcp-mss 0         set inbandwidth 0         set outbandwidth 0         set spillover-threshold 0         set weight 0         set external disable         set description ''         set alias "Server_VLAN"         set l2tp-client disable         set security-mode none         set device-identification disable         set lldp-transmission vdom         set listen-forticlient-connection disable         set vrrp-virtual-mac disable         set snmp-index 8         set secondary-IP disable             config ipv6                 set ip6-mode static                 unset ip6-allowaccess                 set ip6-reachable-time 0                 set ip6-retrans-time 0                 set ip6-hop-limit 0                 set ip6-address ::/0                 set ip6-send-adv disable                 set autoconf disable                 set dhcp6-relay-service disable             end         unset dhcp-relay-ip         set dhcp-relay-type regular         unset macaddr         set speed auto         set mtu-override disable         set wccp disable         set drop-overlapped-fragment disable         set drop-fragment disable     next

[seth57]

Please find design below

[emnoc]

Okay that looks simple, so when  internal1 & 2 are connect you don't see  the layer2 mac-address for either interface once you generated traffic in van1 + 4 ?

Are the  EXports correctly set for speed/duplex and vlan assignments?

[seth57]

Once internal2 is plgged in the switch, the switch port where internal2 is connected going blocked by STP

Ports have the same switching config, just vlan members are differents

[emnoc]

Suggestions;

can you make a 2nd switch profile for  the internal2 port and give that a try?

When you port goes block is it due to received BPDUs?

Can you run a simple diag sniffer on internal1&2 to check the ports to see if your sending BPDUs? and b4 you connect to the juniper? ( just connect a pc host to the ports and run the command below )

e.g

diag sniffer packet internal1 "stp" 5

 and

triple check any switch settings if any;

get sys switch-interface