Virtual Wire and LACP

[os1001]

Hello,

has anyone build a setup where you can transport LACP transparent over a FortiGate?

Our Setup is that the FortiGate will be installed between two Cisco devices which have configured LACP.

The FortiGate should just analyze the traffic and should be transparent for the Cisco's. This works so far except for LACP.

Here is an example of one Port:

config system interface edit "port4" set vdom "Monitor" set fail-detect enable set fail-alert-interfaces "port3" set broadcast-forward enable set l2forward enable set vlanforward enable set stpforward enable set type physical set alias "01-Edge" set snmp-index 8 next end

The Virtual Wires are configured with Wildcard VLANs.

This is the reason why we need to use the Virtual Wire. In the Transparent we needed to configure for every VLAN an interface if we wanted to analyze the traffic. This would have blow up the configuration.

Am I missing something?

I can see that on port4 the LACP message from the Cisco device is seen, but it will be not transported to port3 (which is the partner of the virtual wire).

Regards,

Oliver

[qingyuau]

Hi os1001,

Did you have the issue resolved?

I had a similar issue which both ends runs LACP, Fortigate virtual wire pair inline stopped the LACP establishement.

Thanks

George

[mricardez]

Hi,

The LACP PDUs are packets on L2, so in order to allow the forward of L2 on fortigate VWP, you can try enabling l2forward at interface level.

You also needs to consider forward arp packets.

config system interface
edit <interface_name>
set l2forward enable
end

config system interface
edit <interface_name>
set arpforward enable
end

https://docs.fortinet.com/document/fortigate/6.0.0/handbook/291690/layer-2-and-arp-traffic

Regards