Category Archives: FortiOS 6

Network topologies for managed FortiSwitch units

The FortiGate unit requires only one active FortiLink to manage all of the subtending FortiSwitch units (called stacking).

You can configure the FortiLink as a physical interface or as a logical interface (associated with one or more physical interfaces). Depending on the network topology, you can also configure a standby FortiLink.

NOTE: For any of the topologies:

All of the managed FortiSwitch units will function as one Layer-2 stack where the FortiGate unit manages each FortiSwitch separately.
The active FortiLink carries data as well as management traffic.

Single FortiGate managing a single FortiSwitch unit

On the FortiGate unit, the FortiLink interface is configured as physical or aggregate. The 802.3ad aggregate interface type provides a logical grouping of one or more physical interfaces.

NOTE:

For the aggregate interface, you must disable the split interface on the FortiGate unit.
When you are using the aggregate interface on the FortiGate unit for the FortiLink interface, the lacp-mode of the FortiLink aggregate interface must be set to static.

Network topologies for managed FortiSwitch units Single FortiGate unit managing a stack of several

Single FortiGate unit managing a stack of several FortiSwitch units

The FortiGate unit connects directly to one FortiSwitch unit using a physical or aggregate interface. The remaining FortiSwitch units connect in a ring using inter-switch links (that is, ISL).

Optionally, you can connect a standby FortiLink connection to the last FortiSwitch unit. For this configuration, you create a FortiLink Split-Interface (an aggregate interface that contains one active link and one standby link).

NOTE:

When you are using the aggregate interface on the FortiGate unit for the FortiLink interface, the lacp-mode of the FortiLink aggregate interface must be set to static.
External devices shown in the following topology must be compliant endpoints, such as computers. They cannot be third-party switches or appliances.

HA-mode FortiGate units managing a single FortiSwitch unit

The master and slave FortiGate units both connect a FortiLink to the FortiSwitch unit. The FortiLink port(s) and interface type must match on the two FortiGate units.

NOTE: When using HA-mode FortiGate units to manage FortiSwitch units, the HA mode must be active-passive.

FortiSwitch HA-mode FortiGate units managing a stack of several FortiSwitch units units

HA-mode FortiGate units managing a stack of several FortiSwitch units

The master and slave FortiGate units both connect a FortiLink to the first FortiSwitch unit and (optionally) to the last FortiSwitch unit. The FortiLink ports and interface type must match on the two FortiGate units.

For the active/standby FortiLink configuration, you create a FortiLink Split-Interface (an aggregate interface that contains one active link and one standby link).

NOTE:

When you are using the aggregate interface on the FortiGate unit for the FortiLink interface, the lacp-mode of the FortiLink aggregate interface must be set to static.
When using HA-mode FortiGate units to manage FortiSwitch units, the HA mode must be active-passive.

HA-mode FortiGate units managing a FortiSwitch two-tier

topology FortiSwitch units

HA-mode FortiGate units managing a FortiSwitch two-tier topology

The distribution FortiSwitch unit connects to the master and slave FortiGate units. The FortiLink port(s) and interface type must match on the two FortiGate units.

NOTE: When using HA-mode FortiGate units to manage FortiSwitch units, the HA mode must be active-passive.

Single FortiGate unit managing multiple FortiSwitch units (using a hardware or

FortiSwitch units software switch interface)

Single FortiGate unit managing multiple FortiSwitch units (using a hardware or software switch interface)

The FortiGate unit connects directly to each FortiSwitch unit. Each of these FortiLink ports is added to the logical hardware-switch or software-switch interface on the FortiGate unit.

Optionally, you can connect other devices to the FortiGate logical interface. These devices, which must support IEEE 802.1q VLAN tagging, will have Layer 2 connectivity with the FortiSwitch ports.

NOTE: Using the hardware or software switch interface in FortiLink mode is not recommended in most cases. It can be used when the traffic on the ports is very light because all traffic across the switches moves through the FortiGate unit.

HA-mode FortiGate units managing two-tier FortiSwitch units with Network topologies for managed FortiSwitch access rings units

HA-mode FortiGate units managing two-tier FortiSwitch units with access rings

HA-mode FortiGate units connect to redundant distribution FortiSwitch units. Access FortiSwitch units are arranged in a stack in each IDF, connected to both distribution switches.

For the FortiLink connection to each distribution switch, you create a FortiLink split interface (an aggregate interface that contains one active link and one standby link).

NOTE:

Before FortiSwitchOS 3.6.4, MCLAG was not supported when access rings were present. Starting with FortiSwitchOS 3.6.4, MCLAG is supported, even with access rings present.
When using HA-mode FortiGate units to manage FortiSwitch units, the HA mode must be active-passive.
When you are using the aggregate interface on the FortiGate unit for the FortiLink interface, the lacp-mode of the FortiLink aggregate interface must be set to static.
This is only an example topology. Other combinations of FortiGate units and FortiSwitch units can be used to create a similar topology.

Dual-homed servers connected to FortiLink tier-1 FortiSwitch units using

FortiSwitch units an MCLAG

Dual-homed servers connected to FortiLink tier-1 FortiSwitch units using an MCLAG

To configure a multichassis LAG, you need to configure FortiSwitch 1 and FortiSwitch 2 as MCLAG peer switches before creating a two-port LAG. Use the set mclag-icl enable command to create an inter-chassis link (ICL) on each FortiSwitch unit. Then you set up two MCLAGs towards the servers, each MCLAG using one port from each FortiSwitch unit. You must disable the FortiLink split interface for the FortiGate unit.

This topology is supported when the FortiGate unit is in HA mode.

Standalone FortiGate unit with dual-homed FortiSwitch access

This network topology provides high port density with two tiers of FortiSwitch units.

Use the set mclag-icl enable command to create an ICL on each FortiSwitch unit.

HA-mode FortiGate units with dual-homed FortiSwitch access

In HA mode, only one FortiGate is active at a time. If the active FortiGate unit fails, the backup FortiGate unit becomes active.

Use the set mclag-icl enable command to create an ICL on each FortiSwitch unit.

NOTE: When using HA-mode FortiGate units to manage FortiSwitch units, the HA mode must be active-passive.

Multi-tiered MCLAG with HA-mode FortiGate units

NOTE:

When using HA-mode FortiGate units to manage FortiSwitch units, the HA mode must be active-passive.
In this topology, you must use the auto-isl-port-group setting as described in the following configuration example. This setting instructs the switches to group ports from MCLAG peers together into one MCLAG when the inter-switch link (ISL) is formed.
The inter-chassis link (ICL) and auto-isl-port-group settings must be done directly on the FortiSwitch unit. l CLI commands in red are manually configured.
In a two-tier MCLAG topology, disable STP on the first tier MCLAG peer group with the following commands on each peer switch and do not use access-ring connections on first tier MCLAG peer groups:

config switch global

set mclag-stp-aware disable end

To configure a multi-tiered MCLAG with HA-mode FortiGate units:

Configure FortiSwitch-1 for the tier-1 MCLAG:
Enable the ICL on the ISL formed with the MCLAG peer switch:

config switch trunk edit “D243Z14000288-0” // trunk name derived from FortiSwitch-2 SN set mode lacp-active set auto-isl 1

Multi-tiered MCLAG with HA-mode FortiGate

set mclag-icl enable set members “port21” “port22” end

Configure the two auto-isl-port-groups based on the topology diagram. The group name must match the name that is configured on the peer switch.

config switch auto-isl-port-group edit “mclag-core1” set members “port1” “port2” next

edit “mclag-core2” set members “port3” “port4” end

After you complete the CLI commands in Steps 1a and 1b, the trunks are automatically formed:

config switch trunk edit “D243Z14000288-0” set mode lacp-active set auto-isl 1 set mclag-icl enable set members “port21” “port22” next

edit “__FoRtI1LiNk0__” set mclag enable set members “port24” “port23” next

edit “8DN4K16000360-0” // trunk name derived from FortiSwitch-3 SN set mode lacp-active set auto-isl 1 set mclag enable set members “port20” next

edit “mclag-core1” set mode lacp-active set auto-isl 1 set mclag enable set members “port1” “port2” next

edit “mclag-core2” set mode lacp-active set auto-isl 1 set mclag enable set members “port3” “port4” next

end

Configure FortiSwitch-2 for the tier-1 MCLAG:
Enable the ICL on the ISL formed with the MCLAG peer switch:

config switch trunk edit “D243Z14000289-0” // trunk name derived from FortiSwitch-1 SN

set mode lacp-active set auto-isl 1 set mclag-icl enable set members “port21” “port22” end

Configure the two auto-isl-port-groups based on the topology diagram. The group name must match the name that is configured on the peer switch.

config switch auto-isl-port-group edit “mclag-core1” set members “port1” “port2” next

edit “mclag-core2” set members “port3” “port4” end

After you complete the CLI commands in Steps 2a and 2b, the trunks are automatically formed:

config switch trunk edit “D243Z14000288-0” set mode lacp-active set auto-isl 1 set mclag-icl enable set members “port21” “port22” next

edit “__FoRtI1LiNk0__” set mclag enable set members “port24” “port23” next

edit “8DN4K16000360-0” // trunk name derived from FortiSwitch-3 SN set mode lacp-active set auto-isl 1 set mclag enable set members “port20” next

edit “mclag-core1” set mode lacp-active set auto-isl 1 set mclag enable set members “port1” “port2” next

edit “mclag-core2” set mode lacp-active set auto-isl 1 set mclag enable set members “port3” “port4” next

end

Tier-2 MCLAGs. Enable the ICL between the MCLAG peers. For example, configure FortiSwitch-6 as follows.
Change the tier-2 MCLAG peer switches to FortiLink mode and connect them to each other. Enable the ICL on the ISL formed with the MCLAG peer switches.

Multi-tiered MCLAG with HA-mode FortiGate

config switch trunk edit “8DN3X15000026-0” // trunk name derived from FortiSwitch-7 SN set mode lacp-active set auto-isl 1 set mclag-icl enable set members “port43” “port44”

end

The trunks are automatically formed as below:

config switch trunk edit “8DN3X15000026-0” set mode lacp-active set auto-isl 1 set mclag-icl enable set members “port43” “port44”

edit “8EP3X17000051-0” // trunk name derived from FortiSwitch-11 SN set mode lacp-active set auto-isl 1 set mclag enable set members “port45”

edit “_FlInK1_MLAG0_” set mode lacp-active set auto-isl 1 set mclag enable set members “port48” “port47”

edit “8EP3X17000069-0” // trunk name derived from FortiSwitch-12 SN set mode lacp-active set auto-isl 1 set mclag enable set members “port46”

end

Access FortiSwitch units. The access switch trunks are formed automatically as below.

On FortiSwitch-11:

config switch trunk edit “_FlInK1_MLAG0_” set mode lacp-active set auto-isl 1 set mclag enable set members “port48” “port47”

end

On FortiSwitch-12:

config switch trunk edit “_FlInK1_MLAG0_” set mode lacp-active set auto-isl 1 set mclag enable set members “port47” “port48”

end

Grouping

Grouping FortiSwitch units

You can simplify the configuration and management of complex topologies by creating FortiSwitch groups. A group can include one or more FortiSwitch units and you can include different models in a group.

config switch-controller switch-group edit <name> set description <string> set members <serial-number> <serial-number> … end

end

Grouping FortiSwitch units allows you to restart all of the switches in the group instead of individually. For example, you can use the following command to restart all of the FortiSwitch units in a group named my-swgroup: execute switch-controller restart-swtp my-switch-group

Upgrading the firmware of FortiSwitch groups is easier, too, because fewer commands are needed. See Firmware upgrade of stacked or tiered FortiSwitch units on page 57.

Stacking configuration

To set up stacking:

Configure the active FortiLink interface on the FortiGate unit.
(Optional) Configure the standby FortiLink interface.
Connect the FortiSwitch units together, based on your chosen topology.

1. Configure the active FortiLink

Configure the FortiLink interface (as described in the FortiLink configuration using the FortiGate GUIchapter).

When you configure the FortiLink interface, the stacking capability is enabled automatically.

2. Configure the standby FortiLink

Configure the standby FortiLink interface. Depending on your configuration, the standby FortiLink might connect to the same FortiGate unit as the active FortiLink or to a different FortiGate unit.

If the FortiGate unit receives discovery requests from two FortiSwitch units, the link from one FortiSwitch unit will be selected as active, and the link from other FortiSwitch unit will be selected as standby.

If the active FortiLink fails, the FortiGate unit converts the standby FortiLink to active.

3. Connect the FortiSwitch units

Refer to the topology diagrams to see how to connect the FortiSwitch units.

Inter-switch links (ISLs) form automatically between the stacked switches.

The FortiGate unit will discover and authorize all of the FortiSwitch units that are connected. After this, the FortiGate unit is ready to manage all of the authorized FortiSwitch units.

Grouping FortiSwitch units

Disable stacking

To disable stacking, execute the following commands from the FortiGate CLI. In the following example, port4 is the FortiLink interface:

config system interface edit port4 set fortilink-stacking disable

end

Firmware upgrade of stacked or tiered FortiSwitch units

In this topology, the core FortiSwitch units are model FS-224D-FPOE, and the access FortiSwitch units are model FS-124D-POE. Because the switches are stacked or tiered, the procedure to update the firmware is simpler. In the following procedure, the four FortiSwitch units are upgraded from 3.6.1 to 3.6.2.

To upgrade the firmware of stacked or tiered FortiSwitch units:

Check that all of the FortiSwitch units are connected and which firmware versions they are running. For example:

execute switch-controller get-conn-status

STACK-NAME: FortiSwitch-Stack-port2

SWITCH-ID VERSION STATUS ADDRESS JOIN-TIME

NAME

S108DV2EJZDAC42F v3.6.0 Authorized/Up 169.254.2.4 Thu Feb 8 17:07:35 2018

–

S108DV4FQON40Q07 v3.6.0 Authorized/Up 169.254.2.5 Thu Feb 8 17:08:37 2018

–

S108DVBWVLH4QGEB v3.6.0 Authorized/Up 169.254.2.6 Thu Feb 8 17:09:13 2018

–

S108DVCY19SA0CD8 v3.6.0 Authorized/Up 169.254.2.2 Thu Feb 8 17:04:41 2018

–

S108DVD98KMQGC44* v3.6.0 Authorized/Up 169.254.2.7 Thu Feb 8 17:10:50 2018

–

Grouping

S108DVGGBJLQQO48* v3.6.0 –	Authorized/Up	169.254.2.3	Thu Feb	8 17:06:57 2018
S108DVKM5T2QEA92 v3.6.0 –	Authorized/Up	169.254.2.8	Thu Feb	8 17:11:00 2018
S108DVZX3VTAOO45 v3.6.0 –	Authorized/Up	169.254.2.9	Thu Feb	8 17:11:00 2018
Managed-Switches: 8	UP: 8	DOWN: 0

Upload the firmware image for each FortiSwitch model (FS-224D-FPOE and FS-124D-POE) from either an FTP or TFTP server. If you are using a virtual domain (VDOM), you must enter the config global command before entering the upload-swtp-image command. For example:

FG100E4Q16004478 (global) # execute switch-controller upload-swtp-image tftp FSW_124D_POEv3-build0382-FORTINET.out 172.30.12.18

Downloading file FSW_124D_POE-v3-build0382-FORTINET.out from tftp server 172.30.12.18… ################## Image checking …

Image MD5 calculating …

Image Saving S124DP-IMG.swtp … Successful!

File Syncing…

FG100E4Q16004478 (global) # execute switch-controller upload-swtp-image tftp FSW_224D_FPOEv3-build0382-FORTINET.out 172.30.12.18

Downloading file FSW_224D_FPOE-v3-build0382-FORTINET.out from tftp server 172.30.12.18… ###################### Image checking …

Image MD5 calculating …

Image Saving S224DF-IMG.swtp … Successful!

File Syncing…

Check which firmware images are available. For example:

FG100E4Q16004478 (root) # execute switch-controller list-swtp-image SWTP Images on AC:

ImageName ImageSize(B) ImageInfo ImageMTime

S124DP-IMG.swtp 19174985 S124DP-v3.6-build382 Mon Oct 2 14:40:54 2017

S224DF-IMG.swtp 23277106 S224DF-v3.6-build382 Mon Oct 2 14:42:55 2017 4. Stage the firmware image for each FortiSwitch model (FS-224D-FPOE and FS-124D-POE). For example:

FG100E4Q16004478 (root) # execute switch-controller stage-tiered-swtp-image ALL S124DPIMG.swtp

Staged Image Version S124DP-v3.6-build382

FG100E4Q16004478 (root) # execute switch-controller stage-tiered-swtp-image ALL S224DFIMG.swtp

Staged Image Version S224DF-v3.6-build382

Check that the correct firmware image is staged for each FortiSwitch unit. For example:

diagnose switch-controller dump network-upgrade status

Running Status Next boot

__________________ ________________________________________ _________ __________________ _________

VDOM : root

S108DVCY19SA0CD8 S108DV-v3.6.0-build4277,171207 (Interim) (0/0/0) S108DV-v3.7.0build4277,171207 (Interim)

S108DV2EJZDAC42F S108DV-v3.6.0-build4277,171207 (Interim) (0/0/0)

Restart the FortiSwitch units after a 2-minute delay. For example:

execute switch-controller restart-swtp-delayed ALL

Grouping FortiSwitch units

When the FortiSwitch units are running again, check that they are running the new firmware version. For example:

execute switch-controller get-conn-status

STACK-NAME: FortiSwitch-Stack-port2
SWITCH-ID NAME	VERSION	STATUS	ADDRESS	JOIN-TIME
S108DV2EJZDAC42F –	v3.6.0	Authorized/Up	169.254.2.4	Thu Feb	8 17:07:35 2018
S108DV4FQON40Q07 –	v3.6.0	Authorized/Up	169.254.2.5	Thu Feb	8 17:08:37 2018
S108DVBWVLH4QGEB –	v3.6.0	Authorized/Up	169.254.2.6	Thu Feb	8 17:09:13 2018
S108DVCY19SA0CD8 –	v3.6.0	Authorized/Up	169.254.2.2	Thu Feb	8 17:04:41 2018
S108DVD98KMQGC44* –	v3.6.0	Authorized/Up	169.254.2.7	Thu Feb	8 17:10:50 2018
S108DVGGBJLQQO48* –	v3.6.0	Authorized/Up	169.254.2.3	Thu Feb	8 17:06:57 2018
S108DVKM5T2QEA92 –	v3.6.0	Authorized/Up	169.254.2.8	Thu Feb	8 17:11:00 2018
S108DVZX3VTAOO45 –	v3.6.0	Authorized/Up	169.254.2.9	Thu Feb	8 17:11:00 2018
Managed-Switches: 8		UP: 8	DOWN: 0

Transitioning from a FortiLink split interface to a FortiLink MCLAG

In this topology, the FortiLink split interface connects a FortiLink aggregate interface from one FortiGate unit to two FortiSwitch units.

NOTE:

This procedure also applies to a FortiGate unit in HA mode. l More links can be added between the FortiGate unit and FortiSwitch unit. l After the MCLAG is set up, only connect the tier-2 FortiSwitch units.
When you are using the aggregate interface on the FortiGate unit for the FortiLink interface, the lacp-mode of the FortiLink aggregate interface must be set to static.

Enable the split interface on the FortiLink aggregate interface. By default, the split interface is enabled. For example:

config system interface edit flinksplit1 set ip 169.254.3.1 255.255.255.0 set allowaccess ping capwap https set vlanforward enable set type aggregate set member port4 port5 set lacp-mode static set fortilink enable

set fortilink-split-interface enable

end

Log into FortiSwitch 2 using the Connect to CLI button in the FortiGate GUI, use the get switch lldp auto-isl-status command to find out the name of the trunk connecting the peer switches, and change the ISL to an ICL. For example:

get switch lldp auto-isl-status config switch trunk

Transitioning from a FortiLink split interface to a FortiLink MCLAG

edit <trunk_name> set mclag-icl enable

end

Log into FortiSwitch 1 using the Connect to CLI button in the FortiGate GUI, use the get switch lldp auto-isl-status command to find out the name of the trunk connecting the peer switches, and change the ISL to an ICL. For example:

get switch lldp auto-isl-status

config switch trunk edit <trunk_name> set mclag-icl enable

end

Log into the FortiGate unit and disable the split interface. For example:

config system interface edit flinksplit1 set fortilink-split-interface disable

end

Enable the LACP active mode.
Check that the LAG is working correctly. For example:

diagnose netlink aggregate name <aggregate_name>

Optional setup tasks Configuring the FortiSwitch management port Optional setup tasks

This section describes the following tasks:

Configuring the FortiSwitch management port on page 62 l Converting to FortiSwitch standalone mode on page 63 l Changing the admin password on the FortiGate for all managed FortiSwitch units on page 63 l Enabling network-assisted device detection on page 64
Limiting the number of parallel process for FortiSwitch configuration on page 64

Configuring the FortiSwitch management port

If the FortiSwitch model has a dedicated management port, you can configure remote management to the FortiSwitch. In FortiLink mode, the FortiGate is the default gateway, so you need to configure an explicit route for the FortiSwitch management port.

Using the Web administration GUI

Go to Network > Static Routes > Create New > Route.
Set Destination to Subnet and enter a subnetwork and mask.
Set Device to the management interface.
Add a Gateway IP address.

Using the FortiSwitch CLI

Enter the following commands:

config router static edit 1 set device mgmt set gateway <router IP address> set dst <router subnet> <subnet mask>

end

In the following example, the FortiSwitch management port is connected to a router with IP address 192.168.0.10:

config router static edit 1 set device mgmt set gateway 192.168.0.10 set dst 192.168.0.0 255.255.0.0

end end

FortiLink configuration using the FortiGate CLI

1 Reply

FortiLink configuration using the FortiGate CLI

This section describes how to configure FortiLink using the FortiGate CLI. Fortinet recommends using the FortiGate GUI because the CLI procedures are more complex (and therefore more prone to error).

If you use one of the auto-discovery FortiSwitch ports, you can establish the FortiLink connection (single port or LAG) with no configuration steps on the FortiSwitch and with a few simple configuration steps on the FortiGate unit.

You can also configure FortiLink mode over a layer-3 network.

Summary of the procedure

Configure FortiLink on a physical port or configure FortiLink on a logical interface.
Configure NTP.
Authorize the managed FortiSwitch unit.
Configure DHCP.

Configure FortiLink on a physical port

Configure FortiLink on any physical port on the FortiGate unit and authorize the FortiSwitch unit as a managed switch.

In the following steps, port 1 is configured as the FortiLink port.

If required, remove port 1 from the lan interface:

config system virtual-switch edit lan config port delete port1

end

Configure port 1 as the FortiLink interface:

config system interface edit port1 set auto-auth-extension-device enable set fortilink enable

end

Configure an NTP server on port 1:

config system ntp set server-mode enable set interface port1 end

Authorize the FortiSwitch unit as a managed switch.

config switch-controller managed-switch edit FS224D3W14000370 set fsw-wan1-admin enable

end

NOTE: The FortiSwitch unit will reboot when you issue the set fsw-wan1-admin enable command.

Configure FortiLink on a logical interface

You can configure FortiLink on a logical interface: link-aggregation group (LAG), hardware switch, or software switch).

NOTE: LAG is supported on all FortiSwitch models and on FortiGate models FGT-100D and above. Hardware switch is supported on some FortiGate models.

Connect any of the FortiLink-capable ports on the FortiGate to the FortiSwitch. Ensure that you configure autodiscovery on the FortiSwitch ports (unless it is auto-discovery by default).

In the following procedure, port 4 and port 5 are configured as a FortiLink LAG.

If required, remove the FortiLink ports from the lan interface:

config system virtual-switch edit lan config port delete port4 delete port5

end

Create a trunk with the two ports that you connected to the switch:

config system interface edit flink1 (enter a name, 11 characters maximum) set ip 169.254.3.1 255.255.255.0 set allowaccess ping capwap https set vlanforward enable set type aggregate set member port4 port5 set lacp-mode static set fortilink enable

(optional) set fortilink-split-interface enable next

end

NOTE: If the members of the aggregate interface connect to more than one FortiSwitch, you must enable fortilink-split-interface.

Authorize the FortiSwitch unit as a managed switch.

config switch-controller managed-switch edit FS224D3W14000370

set fsw-wan1-admin enable

end

NOTE: FortiSwitch will reboot when you issue the set fsw-wan1-admin enable command.

Enable multiple FortiLink interfaces

NOTE: Only the first FortiLink interface has GUI support.

Use the following command to enable or disable multiple FortiLink interfaces.

config switch-controller global set allow-multiple-interfaces {enable | disable}

end

FortiLink mode over a layer-3 network

This feature allows FortiSwitch islands (FSIs) to operate in FortiLink mode over a layer-3 network, even though they are not directly connected to the switch-controller FortiGate unit. FSIs contain one or more FortiSwitch units.

The following limitations apply to FSIs operating in FortiLink mode over a layer-3 network:

All FortiSwitch units using this feature must be included in the FortiGate preconfigured switch table.
No layer-2 data path component, such as VLANs, can span across layer 3 between the FortiGate unit and the FortiSwitch unit.
All FortiSwitch units within an FSI must be connected to the same FortiGate unit.
The FortiSwitch unit needs a functioning layer-3 routing configuration to reach the FortiGate unit or any featureconfigured destination, such as syslog or 802.1x.
Do not connect a layer-2 FortiGate unit and a layer-3 FortiGate unit to the same FortiSwitch unit.
If the FortiSwitch management port is used for a layer-3 connection to the FortiGate unit, the FSI can contain only one FortiSwitch unit. All switch ports must remain in standalone mode.
Do not connect a FortiSwitch unit to a layer-3 network and a layer-2 network on the same segment.
If the network has a wide geographic distribution, some features, such as software downloads, might operate slowly.

To configure a FortiSwitch unit to operate in a layer-3 network:

Reset the FortiSwitch to factory default settings with the execute factoryreset
Manually set the FortiSwitch unit to FortiLink mode:

config system global

set switch-mgmt-mode fortilink end

Configure the discovery setting for the FortiSwitch unit. You can either use DHCP discovery or static discovery.

The default dhcp-option-code is 138.

To use DHCP discovery:

config switch-controller global set ac-discovery dhcp set dhcp-option-code <integer> end

To use static discovery:

config switch-controller global

set ac-discovery static

config ac-list

edit <id>

set ipv4-address <IPv4_address>

end

Configure at least one port of the FortiSwitch unit as an uplink port. When the FortiSwitch is in FortiLink mode, VLAN 4094 is configured on an internal port, which can provide a path to the layer-3 network with the following commands:

config switch interface edit <port_number> set fortilink-l3-mode enable

end

NOTE: The NTP server must be configured on the FortiSwitch unit either manually or provided by DHCP. The NTP server must be reachable from the FortiSwitch unit.

FortiLink configuration using the FortiGate GUI

1 Reply

FortiLink configuration using the FortiGate GUI

You can configure FortiLink using the FortiGate GUI or CLI. Fortinet recommends using the GUI because the CLI procedures are more complex (and therefore more prone to error).

Summary of the procedure

On the FortiGate unit, configure the FortLink port or create a logical FortLink interface.
Authorize the managed FortiSwitch unit.

Configure FortiLink as a single link

To configure the FortiLink port on the FortiGate unit:

Go to Network > Interfaces.
(Optional) If the FortiLink physical port is currently included in the internal interface, edit it and remove the desired port from the Physical Interface Members.
Edit the FortiLink port.
Set Addressing mode to Dedicated to FortiSwitch.
Configure the IP/Network Mask for your network.
Optionally select Automatically authorize devices or disable to manually authorize the FortiSwitch.
Select OK.

Configure FortiLink as a logical interface

You can configure the FortiLink as a logical interface: link-aggregation group (LAG), hardware switch, or software switch).

LAG is supported on all FortiSwitch models and on FortiGate models FGT-100D and above. Hardware switch is supported on some FortiGate models.

Connect any of the FortiLink-capable ports on the FortiGate unit to the FortiSwitch unit. Ensure that you configure auto-discovery on the FortiSwitch ports (unless it is so by default).

Go to Network > Interfaces.
(Optional) If the FortiLink physical ports are currently included in the internal interface, edit the internal interface, and remove the desired ports from the Physical Interface Members.
Select Create New > Interface.
Enter a name for the interface (11 characters maximum).
Set the Type to 3ad Aggregate, Hardware Switch, or Software Switch.
Select the FortiGate ports for the logical interface.
Set Addressing mode to Dedicated to FortiSwitch.
Configure the IP/Network Mask for your network.
Optionally select Automatically authorize devices or disable to manually authorize the FortiSwitch.
Select OK.

FortiLink split interface

You can use the FortiLink split interface to connect the FortiLink aggregate interface from one FortiGate unit to two FortiSwitch units. When the FortiLink split interface is enabled, only one link remains active.

The aggregate interface for this configuration must contain exactly two physical ports (one for each FortiSwitch unit).

You must enable the split interface on the FortiLink aggregate interface using the FortiGate CLI:

config system interface edit <name of the FortiLink interface> set fortilink-split-interface enable

end

Authorizing the FortiSwitch unit

If you configured the FortiLink interface to manually authorize the FortiSwitch unit as a managed switch, perform the following steps:

Go to WiFi & Switch Controller > Managed FortiSwitch.
Optionally, click on the FortiSwitch faceplate and click Authorize. This step is required only if you disabled the automatic authorization field of the interface.

Adding preauthorized FortiSwitch units

After you preauthorize a FortiSwitch unit, you can assign the FortiSwitch ports to a VLAN.

To preauthorize a FortiSwitch:

Go to WiFi & Switch Controller> Managed FortiSwitch.
Click Create New.
In the New Managed FortiSwitch page, enter the serial number, model name, and description of the FortiSwitch.
Move the Authorized slider to the right.
Click OK.

The Managed FortiSwitch page shows a FortiSwitch faceplate for the preauthorized switch.

Managed FortiSwitch display

Go to WiFi & Switch Controller> Managed FortiSwitch to see all of the switches being managed by your FortiGate.

When the FortiLink is established successfully, the status is green (next to the FortiGate interface name and on the FortiSwitch faceplate), and the link between the ports is a solid line.

If the link has gone down for some reason, the line will be dashed, and a broken link icon will appear. You can still edit the FortiSwitch unit though and find more information about the status of the switch. The link to the FortiSwitch unit might be down for a number of reasons; for example, a problem with the cable linking the two devices, firmware versions being out of synch, and so on. You need to make sure the firmware running on the FortiSwitch unit is compatible with the firmware running on the FortiGate unit.

From the Managed FortiSwitch page, you can edit any of the managed FortiSwitch units, remove a FortiSwitch unit from the configuration, refresh the display, connect to the CLI of a FortiSwitch unit, or deauthorize a FortiSwitch unit.

Edit a managed FortiSwitch unit

To edit a managed FortiSwitch unit:

Go to Wifi & Switch Controller> Managed FortiSwitch.
Click on the FortiSwitch to and click Edit, right-click on a FortiSwitch unit and select Edit, or double-click on a FortiSwitch unit.

From the Edit Managed FortiSwitch form, you can:

Change the Name and Description of the FortiSwitch unit. l View the Status of the FortiSwitch unit.
Restart the FortiSwitch.
Authorize or deauthorize the FortiSwitch. l Update the firmware running on the switch.

Network interface display

On the Network > Interfaces page, you can see the FortiGate interface connected to the FortiSwitch unit. The GUI indicates Dedicated to FortiSwitch in the IP/Netmask field.

Add link aggregation groups (Trunks)

To create a link aggregation group for FortiSwitch user ports:

Go to WiFi & Switch Controller> FortiSwitch Ports.
Click Create New > Trunk.
In the New Trunk Group page, enter a Name for the trunk group.
Select two or more physical ports to add to the trunk group.
Select the Mode: Static, Passive LACP, or Active LACP.
Click OK.

Configure DHCP blocking, IGMP snooping, STP, and loop guard on managed FortiSwitch ports

Go to WiFi & Switch Controller> FortiSwitch Ports. Right-click any port and then enable or disable the following features:

DHCP blocking—The DHCP blocking feature monitors the DHCP traffic from untrusted sources (for example, typically host ports and unknown DHCP servers) that might initiate traffic attacks or other hostile actions. To prevent this, DHCP blocking filters messages on untrusted ports.
IGMP snooping—IGMP snooping allows the FortiSwitch to passively listen to the Internet Group Management Protocol (IGMP) network traffic between hosts and routers. The switch uses this information to determine which ports are interested in receiving each multicast feed. FortiSwitch can reduce unnecessary multicast traffic on the LAN by pruning multicast traffic from links that do not contain a multicast listener.
Spanning Tree Protocol (STP)—STP is a link-management protocol that ensures a loop-free layer-2 network topology.
Loop guard—A loop in a layer-2 network results in broadcast storms that have far-reaching and unwanted effects. Fortinet loop guard helps to prevent loops. When loop guard is enabled on a switch port, the port monitors its subtending network for any downstream loops. The loop guard feature is designed to work in concert with STP rather than as a replacement for STP.
STP root guard—Root guard protects the interface on which it is enabled from becoming the path to root. When enabled on an interface, superior BPDUs received on that interface are ignored or dropped. Without using root guard, any switch that participates in STP maintains the ability to reroute the path to root. Rerouting might cause your network to transmit large amounts of traffic across suboptimal links or allow a malicious or misconfigured device to pose a security risk by passing core traffic through an insecure device for packet capture or inspection. By enabling root guard on multiple interfaces, you can create a perimeter around your existing paths to root to enforce the specified network topology.
STP BPDU guard—Similar to root guard, BPDU guard protects the designed network topology. When BPDU guard is enabled on STP edge ports, any BPDUs received cause the ports to go down for a specified number of minutes. The BPDUs are not forwarded, and the network edge is enforced.

Connecting FortiLink ports

Leave a reply

Connecting FortiLink ports

This section contains information about the FortiSwitch and FortiGate ports that you connect to establish a FortiLink connection.

In FortiSwitchOS 3.3.0 and later releases, you can use any of the switch ports for FortiLink. Some or all of the switch ports (depending on the model) support auto-discovery of the FortiLink ports.

You can chose to connect a single FortiLink port or multiple FortiLink ports as a logical interface (link-aggregation group, hardware switch, or software switch).

1. Enable the switch controller on the FortiGate unit

Before connecting the FortiSwitch and FortiGate units, ensure that the switch controller feature is enabled on the FortiGate unit with the FortiGate web-based manager or CLI to enable the switch controller. Depending on the FortiGate model and software release, this feature might be enabled by default.

Using the FortiGate GUI

Go to System > Feature Visibility.
Turn on the Switch Controller feature, which is in the Basic Features
Select Apply.

The menu option WiFi & Switch Controller now appears.

Using the FortiGate CLI

Use the following commands to enable the switch controller:

config system global set switch-controller enable

end

2. Connect the FortiSwitch unit and FortiGate unit

FortiSwitchOS 3.3.0 and later provides flexibility for FortiLink:

Use any switch port for FortiLink l Provides auto-discovery of the FortiLink ports on the FortiSwitch
Choice of a single FortiLink port or multiple FortiLink ports in a link-aggregation group (LAG)

Auto-discovery of the FortiSwitch ports

In FortiSwitchOS 3.3.0 and later releases, D-series FortiSwitch models support FortiLink auto-discovery, on automatic detection of the port connected to the FortiGate unit.

You can use any of the switch ports for FortiLink. Before connecting the switch to the FortiGate unit, use the following FortiSwitch CLI commands to configure a port for FortiLink auto-discovery:

config switch interface edit <port>

set auto-discovery-fortilink enable

end

By default, each FortiSwitch model provides a set of ports that are enabled for FortiLink auto-discovery. If you connect the FortiLink using one of these ports, no switch configuration is required.

In FortiSwitchOS 3.4.0 and later releases, the last four ports are the default auto-discovery FortiLink ports. You can also run the show switch interface command on the FortiSwitch unit to see the ports that have autodiscovery enabled.

The following table lists the default auto-discovery ports for each switch model.

NOTE: Any port can be used for FortiLink if it is manually configured.

FortiSwitch Model	Default Auto-FortiLink ports
FS-108D	ports 9 and 10
FS-108D-POE	ports 9 and 10
FSR-112D	ports 9, 10, 11 and 12
FSR-112D-POE	ports 5, 6, 7, 8, 9, 10, 11, and 12
FS-124D, FS-124D-POE	ports 23, 24, 25, and 26
FS-224D-POE	ports 21, 22, 23, and 24
FS-224D-FPOE	ports 21, 22, 23, 24, 25, 26, 27, and 28
FS-248D, FS-248D-FPOE, FS-448D, FS448D-FPOE, FS-448D-POE	ports 45, 46, 47, 48, 49, 50, 51, and 52
FS-248D-POE	ports 47, 48, 49, and 50
FS-424D, FS-424D-POE, FS-424D-FPOE	ports 23, 24, 25, and 26
FS-524D, FS-524D-FPOE	ports 21, 22, 23, 24, 25, 26, 27, 28, 29, and 30
FS-548D, FS-548D-FPOE	ports 45, 46, 47, 48, 49, 50, 51, 52, 53, and 54
FS-1024D, FS-1048D, FS-3032D	all ports

Choosing the FortiGate ports

The FortiGate unit manages all of the switches through one active FortiLink. The FortiLink can consist of one port or multiple ports (for a LAG).

Connect the FortiSwitch unit and FortiGate unit Connecting FortiLink ports

As a general rule, FortiLink is supported on all ports that are not listed as HA ports.

Upgrade the firmware on multiple FortiSwitch units at the same time using the GUI

Leave a reply

Upgrade the firmware on multiple FortiSwitch units at the same time using the GUI (462553)

To upgrade the firmware on multiple FortiSwitch units at the same time:

Go to WiFi & Switch Controller> Managed FortiSwitch.
Select the faceplates of the FortiSwitch units that you want to upgrade.
Click Upgrade.

The Upgrade FortiSwitches page opens.

Select FortiGuard or select Upload and then select the firmware file to upload.

You can select only one firmware image to use to upgrade the selected FortiSwitch units. If the FortiSwitch unit already has the latest firmware image, it will not be upgraded.

Select Upgrade.

CLI changes for FortiLink mode

Leave a reply

CLI changes for FortiLink mode (447349, 473773)

There are changes to the execute switch-controller get-physical-connection, execute switch-controller get-conn-status, and diagnose switch-controller dump networkupgrade status CLI commands.

The execute switch-controller get-physical-connection CLI command has new parameters:

Use the execute switch-controller get-physical-connection standard command to get the FortiSwitch stack connectivity graph in the standard output format.

Use the execute switch-controller get-physical-connection dot command to get the

FortiSwitch stack connectivity graph in a .dot (Graphviz) output format.

The execute switch-controller get-conn-status CLI command output now includes virtual

FortiSwitch units. Virtual FortiSwitch units are indicated by an asterisk (*) after the switch identifier. For example:

execute switch-controller get-conn-status

STACK-NAME: FortiSwitch-Stack-port2
SWITCH-ID VERSION	STATUS	ADDRESS	JOIN-TIME		NAME
S108DV2EJZDAC42F v3.6.0	Authorized/Up	169.254.2.4	Thu Feb	8 17:07:35 2018	–
S108DV4FQON40Q07 v3.6.0	Authorized/Up	169.254.2.5	Thu Feb	8 17:08:37 2018	–
S108DVBWVLH4QGEB v3.6.0	Authorized/Up	169.254.2.6	Thu Feb	8 17:09:13 2018	–
S108DVCY19SA0CD8 v3.6.0	Authorized/Up	169.254.2.2	Thu Feb	8 17:04:41 2018	–
S108DVD98KMQGC44* v3.6.0	Authorized/Up	169.254.2.7	Thu Feb	8 17:10:50 2018	–
S108DVGGBJLQQO48* v3.6.0	Authorized/Up	169.254.2.3	Thu Feb	8 17:06:57 2018	–
S108DVKM5T2QEA92 v3.6.0	Authorized/Up	169.254.2.8	Thu Feb	8 17:11:00 2018	–
S108DVZX3VTAOO45 v3.6.0	Authorized/Up	169.254.2.9	Thu Feb	8 17:11:00 2018	–
Managed-Switches: 8	UP: 8	DOWN: 0

The diagnose switch-controller dump network-upgrade status CLI command output now

includes the location of the image that is loaded when the FortiSwitch unit is restarted. If the Next boot column is blank, the FortiSwitch unit uses the same location each it is restarted. The status column shows the percentage downloaded, the percentage erased in flash memory, and the percentage written to flash memory.

For example:

diagnose switch-controller dump network-upgrade status

Running Status Next boot

__________________ ________________________________________ _________ ___________________________ VDOM : root

S108DVCY19SA0CD8 S108DV-v3.6.0-build4277,171207 (Interim) (0/0/0) S108DV-v3.7.0build4277,171207 (Interim)

S108DV2EJZDAC42F S108DV-v3.6.0-build4277,171207 (Interim) (0/0/0)

Limiting the number of parallel process for FortiSwitch configuration (457103)

Leave a reply

Limiting the number of parallel process for FortiSwitch configuration (457103)

Use the following CLI commands to reduce the number of parallel process that the switch controller uses for configuring FortiSwitch units: config global config switch-controller system set parallel-process-override enable set parallel-process <1-300>

end

Testing 802.1x authentication with monitor mode (480807)

Leave a reply

Testing 802.1x authentication with monitor mode (480807)

Use the monitor mode to test your system configuration for 802.1x authentication. You can use monitor mode to test port-based authentication, MAC-based authentication, EAP pass-through mode, and MAC authentication bypass. Monitor mode is disabled by default. After you enable monitor mode, the network traffic will continue to flow, even if the users fail authentication.

To enable or disable monitor mode, use the following commands:

config switch-controller security-policy 802-1X edit “<policy_name>”

set open-auth {enable | disable}

end