Virtual Wire and Spanning-Tree / STP BPDU

[topcu]

Hi there,

does anyone know, how a fortigate handles Spanning Tree BPDUs on a virtual wire?

In my scenario, the FG (100D v5.6.2,build1486) is connected between two Switches, which in turn are interconnected (through the FG) via a VLAN-tagged Link. When analyzing the BPDUs with the diagnose sniffer command, I see incoming BPDUs only on one of the both ports. These BPDUs in turn are not sent out of the other port.

Scenario:

[SWITCH1] --- Port16 [FG ViWi] Port15 --- [SWITCH2]

Configuration:

config system interface

    edit "port15"         set vdom "VD-TEST"         set vlanforward enable         set type physical         set snmp-index 11     next     edit "port16"         set vdom "VD-TEST"         set vlanforward enable         set type physical         set snmp-index 12     next

config system virtual-wire-pair     edit "VW-TEST"         set member "port15" "port16"         set wildcard-vlan enable     next end

In my understanding, the Virtual Wire shold be bidirectional transparent to any Packet and Layer-2 Frame. But it looks like it does not. BPDUs are not seen on both ports, but only on one, and those BDPUs are not forwarded out the other port.

Any other IP packets are forwarded well.

... # diag sniffer packet any stp 4 [style="background-color: #ffff00;"][size="2"]interfaces=[any][/size][/style] [size="2"]filters=[stp][/size] [size="2"]0.758120 [style="background-color: #ffff00;"]port15 [/style]in stp 802.1w, rapid stp, flags [learn, forward], bridge-id 4383.68:bd:ab:74:5b:80.8012[/size] [size="2"]0.818118 [style="background-color: #ffff00;"]port15[/style] in stp 802.1w, rapid stp, flags [learn, forward], bridge-id 4383.a8:b1:d4:f8:c6:00.8011[/size] [size="2"]1.618088 [style="background-color: #ffff00;"]port15[/style] in stp 802.1w, rapid stp, flags [learn, forward], bridge-id 8001.00:22:bd:59:8c:80.8014[/size] [size="2"]1.828073 [style="background-color: #ffff00;"]port15[/style] in stp 802.1w, rapid stp, flags [learn, forward], bridge-id 4383.68:bd:ab:9f:0b:00.800c[/size] [size="2"]1.978068 [style="background-color: #ffff00;"]port15[/style] in stp 802.1w, rapid stp, flags [learn, forward], bridge-id 8383.10:8c:cf:55:75:80.800a[/size] [size="2"]1.988068 [style="background-color: #ffff00;"]port15[/style] in stp 802.1w, rapid stp, flags [learn, forward], bridge-id 4383.68:bd:ab:52:2c:80.8012[/size] [size="2"]1.998067 [style="background-color: #ffff00;"]port15[/style] in stp 802.1w, rapid stp, flags [learn, forward], bridge-id 4383.68:bd:ab:52:4b:00.8010[/size]

[size="2"][...][/size]

Any Idea?

Thanks in advance / best regards

Hakan

[akomili]

I know this is an old post, but I came across it when troubleshooting the same issue. The solution for us was to set stpforward to enable on the ports:

config system interface     edit "port15"         set stpforward enable     next     edit "port16"         set stpforward enable     next

https://kb.fortinet.com/kb/documentLink.do?externalID=FD48894