auto-isl-port-group best practice

[Dan_Eng52]

Hi all, 

Wonder if someone can help me understand the use case for the auto-isl-port-group command on FortiSwitch. Taking the below diagram as an example, if the the distribution layer layer is already configured for MCLAG ICL when the access layer switches are attached the distribution layer switches will automatically establish automatically a trunk as per below:

edit "_FlInK1_MLAG0_"
set mode lacp-active
set auto-isl 1
set mclag enable
set members "port29" "port30"

Since these trunks are automatically established when connecting switches to an exiting MCLAG ICL peer group what is the use case for the auto-isl-port-group command and what difference is there in letting the trunks establish automatically rather than manually setting the auto-isl-port-group? 

Thanks in advance. 

Dan_Eng52

[Dan_Eng52]

Hi Sachit Das, 

Understood, I currently have a multi-tier deployment with automatically created trunks between the MCLAG tiers. Is this only recommended when connected a single switch to a MCLAG tier to let the trunks automatically establish and in this case doesn't require the auto-isl-port-group?

If there trunks are automatically established between the MCLAG tiers is it possible to issue this command live? Would the links establish correctly or is it best to delete the automatically generated trunks and disconnect the MCLAG tiers, issue the command and repatch?

Regards, 

Dan.

[Gatlinllon]

In my network setup, I have distribution layer switches configured for MCLAG ICL, and I'm looking to understand how the 'auto-isl-port-group' command fits into this scenario. From what I gather, when access layer switches are connected to the distribution layer switches of nokomis real estate, the 'auto-isl-port-group' command facilitates the automatic establishment of trunk links. I'm uncertain about its interaction with MCLAG and how it impacts network performance and VLAN propagation.

[Dan_Eng52]

Hi Gatlinllon, 

This will need to be configured only on links connecting to downstream tiers if you have a multi-tier deployment, the auto-isl-group name must match among MCLAG-ICL peers. This setting instructs the switches to group ports from MCLAG peers together into one MCLAG when the inter-switch link (ISL) is formed.

In the initial phase of deployment I didn't have this setup and the FortiSwitch devices established their ISL's automatically. Although this is not recommended by design this did not cause any STP issue or inconsistencies. I have since however, resolved this by issuing the below custom command on the FortiGate switch-controller since I have a full-stack deployment. 

config switch auto-isl-port-group
edit tier-2
set members port29 port30
end

config switch-controller custom-command
edit "auto-isl-port-group-tier-2"
set command "config switch auto-isl-port-group %0a edit tier-2 %0a set members port29 port30 %0a end %0a"
end

In your case if you are connecting multi-tiers, this is required on the downstream links. Without it, there is a possibility of causing STP issue and inconsistencies which could affect network and since it is a recommendation and easy to implement. 

If you're not implementing multi-tier MCLAG you do not need to worry about this. 

Thanks, 

Dan.