Windows NLB Exchange 2013 Multicast or IGMP Multicast thru FGT & FortiSwitches [SOLVED

[DevinderSharma]

Hi Members,

I see few posts partially around this subject, but no real solution arrived in there. We need to move a customer from Cisco infrastructure to a cluster of two fortigates (active / passive) and 6 fortiswitches and they have an Exchange 2013 cluster of two members. The equipment is on its way, so I don't have any way to test at my end. I am just going thru documentation or doing google search.

Current Cisco solution has the static arp entry for the Exchange cluster Virtual IP address to its multicast address, something like 

arp 192.168.10.50 03bf.ac20.141e arpa

mac address-table static 03bf.ac20.141e vlan 10 interface GigabitEthernet1/11 GigabitEthernet1/12 GigabitEthernet1/47 GigabitEthernet1/48

By default IGMP snopping is on both L3 and L2 stack, and L3 switch (stack of two) has IGMP querier set up 

ip igmp snooping querier vlan configuration 10 ip igmp snooping querier address 192.168.10.1

Will something like the following on the Fortigate firewall LAN interface correctly set up this static arp entry?

config system arp-table     edit  1     set interface internal     set ip 192.168.10.50     set mac 03:BF:AC:20:14:1E end

And is there such option available on the fortigate managed Fortiswitches?

And for Fortigate to act as IGMP querier:

config router multicast

set multicast-routing enable

config interface     edit internal     config igmp     set version 2     set pim-mode sparse-mode

end

Since this is an old and common technique used for Microsoft Clustering, I am hoping many of you have done this with Fortigate and Fortiswitches. So any advice will be much appreciated.

[DevinderSharma]

Further to my post, I believe the following will be needed on the fortigate for managed fortiswitches.

config switch-controller igmp-snooping set flood-unknown-multicast enable end config switch-controller managed-switch edit Sxxxxxx config static-mac edit 1 set type static set mac 03:BF:AC:20:14:1E set interface port3,port4 end config ports edit port3,port4 set igmp-snooping enable set igmps-flood-reports enable

Thanks

[DevinderSharma]

Some versions of Cisco switches (like nexus) and HPe switches have the option to include multicast when adding the mac address to the table for the ports.

mac address-table multicast 03bf.ac20.141e vlan 10 interface Ethernet1/11 Ethernet1/12 Ethernet1/47 Ethernet1/48

Do we need any change accordingly in the Fortigate for the switches to add the mac address if it is a multicast address?

Thanks

[DevinderSharma]

Since the fortiswitches managed by fortigate are treated all different switches and not as a stack, can we do cross switch LACP LAG / teaming to connect servers with multiple NICs to different switches? Will it at least cause one of the port of the two different switch ports to be blocked by LACP at least to offer an active / passive LAG if cross switch LAG will not be possible?

Thanks

[DevinderSharma]

I was able to get hold of a customer firewall and switch that are not in production yet and I tried to add the mac address to a port with address starting with 03bf and I got the error:

"Multicast mac address not allowed"

The same multicast mac address is accepted both as arp entry and as mac address for the table in Cisco switch with no issues. I tested that portion with cisco switches yesterday. So in such situation, can we conclude that we can not support traditional Microsoft NLB with Multicast mode (without IGMP) and that we will need to have customer change the cluster mode to IGMP multicast. IGMP multicast mode then should not need these static mac entries, though we will still need the upstream fortigate to act as IGMP querier and on that interface of fortigate, we will need to add arp entry, which is accepted without error?

Thanks

[DevinderSharma]

Answering this question myself. In absence of physical equipment, I was able to find answers to this in fortiswitch documentation as well as came across this link below that provided what I was looking for. I was then able to validate this with a remote session with my friendly and very helpful Fortinet SE's lab which had the required fortiswitches managed by Fortigate. Essentially, Microsoft proprietary NLB multicast mode is not supported by Fortinet switches as it rejects inputting a multicast mac address for the Virtual IP of the NLB cluster. Only option is to use IGMP multicast and that does not then have any such requirement to put in static arp and static mac entries. However for a local LAN needs, its is better to have the switch become the required IGMP querier and thus not to burden the Fortigate that is upstream and managing the switches. The basic GUI and CLI options available under Fortigate GUI for managing the switches do not allow setting the switch as a IGMP Querier. The link below explains beautifully what needs to be done to achieve what I needed. Hope this helps others as well as I appreciate the author of the link below for documenting it so clearly.

https://www.brg.ch/igmp-snooping-querier-with-managed-fortiswitch/