"Fortiextender LAN Extension" interface type in Fortimanager?

[lexagl]

Hi all,

I'm doing a trial setup of some FortiExtender FEX-202Fs with my existing Fortigate 91Gs which are managed via a FortiManager VM. I plan on using these as LAN extenders for remote microsites. I've managed to get the FEX units working well with the FGTs on their own, but the trouble comes when I try to use FMG to create firewall policies involving the FEX interfaces. 

In the FGT UI, I can see the FEX units correctly appearing under the "LAN Extension" category. Firewall polices work fine when configured directly on the gates. However, when the FGT configs are imported into FMG these same interfaces appear as the "VLAN" type. I am then not able to select these interfaces when making firewall polices. I'm assuming this is because the "role" variable on the erroneous VLAN page for these interfaces is set to "Undefined". Unfortuantely I am not able to change the interface role, as an error message appears notfying that "VLAN ID must be between 1-4096", but the option to set a VLAN ID is greyed-out ... all of this despite the interface not actually being of the VLAN type in the first place.

I see in FMG there is an option to create a Fortigate interface of the "FortiExtender WAN extension" type, but I do not see a corresponding option for a "LAN extension" type.

Firmware versions involved:

Fortigates: 7.4.7 build2731

Fortimanager: 7.4.6 build2588

Images:

LAN Extension as it appears directly in the Fortigate UI:

Same interface as it appears in the Fortimanager UI:

Edit interface menu in Fortimanager for the above:

Sorry for the long post. Thanks in advance!

[funkylicious]

maybe its related to https://docs.fortinet.com/document/fortimanager/7.4.6/administration-guide/201336/managing-fortiexte... 

[lexagl]

I followed those steps and the FEX shows correctly in the FMG Extender Manager page as a LAN extension. However, the interface still shows incorrectly as a "VLAN" type in the gate's page under device manager. 

[funkylicious]

may try importing again the config from the device and hopefully it makes another mapping type.

[lexagl]

Importing again didn't work but I did find a very inconvenient workaround:

1. Delete the Fortextender entirely from the Fortigate

2. Delete the Fortigate from Fortimanager

3. Add the Fortiextender back to the Fortigate directly

4. Add the Fortigate back to Fortimanager.

This results in the LAN Extender interface now showing as an "Unknown" type in FMG. However, it has the correct LAN role, the FEX is properly displaying in Extender Manager, and it can now be referenced in firewall policies pushed by Fortimanager. It isn't pretty but it works in my case. I imagine this is still a bug, however.

[lexagl · Accepted solution]

Correction to the above, I’ve found the only necessary steps are to remove the Fortigate and then add it back to the Fortimanager.

I’m going to mark this as the solution, though it’s certainly a bug with Fortimanager that needs fixing.