MAC layer control – Sticky MAC and MAC Learning-limit

MAC layer control – Sticky MAC and MAC Learning-limit

Persistent MAC learning, or Sticky MAC, is a port security feature that lets an interface retain dynamically learned MAC addresses when a switch is restarted, or an interface goes down and then is brought back online.

Enabling Sticky MAC along with MAC Learning-limit restricts the number of MAC addresses that are learned. This prevents layer 2 Denial of Service (DoS) attacks, overflow attacks on the Ethernet switching table, and DHCP starvation attacks by limiting the number of MAC addresses that are allowed while still allowing the interface to learn a specified number of MAC addresses. The interface is secured because, after the specified limit has been reached, additional devices cannot connect to the port. Interfaces can be allowed to learn the MAC address of trusted workstations and servers from the time that the interfaces are connected to the network, until the MAC address limit is reached.

Prerequisites

  • Sticky MAC save is hardware and CPU intensive if there are too many entries.
  • Dual chip device models (X48 and XX48 FortiSwitch models) do not support MAC Learning-limit on VLANs, but still support it on FortiSwitch ports.

Enable Sticky MAC on the FortiSwitch ports view:

config switch-controller managed-switch edit S248EPTF18001384 config ports edit port6 set sticky-mac enable

next

end

next

end

Check the MAC-table on the FortiSwitch to see that the status of related MAC items on the Sticky MAC enabled ports has changed from dynamic to static:

Before Sticky-MAC is enabled:

diagnose switch mac-address list

MAC: 08:5b:0e:06:6a:d4 VLAN: 1 Port: port1(port-id 1) Flags: 0x00030440 [ hit dynamic src-hit native move ]

After Sticky-MAC is enabled:

diagnose switch mac-address list

MAC: 00:0c:29:d4:4f:3c VLAN: 1 Port: port6(port-id 6) Flags: 0x00000020 [ static ]

Save Sticky-MAC items into the database and delete others:

Saving Sticky-MAC items from the running memory into the database, and deleting unsaved items, will ensure that, even after the FortiSwitch is rebooted, the trusted MAC addresses will be kept and will not need to be relearned.

execute switch-controller switch-action sticky-mac save all S248EPTF1800XXXX S248EPTF1800XXXX: Save started…

Warning: Please wait save will take longer time upto 30 seconds…

Collecting config data….Done

Collecting hardware data….Done

Saving….Done

Sticky MAC entries saved = 1 —————-> Number of saved Sticky MAC items is shown execute switch-controller switch-action sticky-mac delete-unsaved all S248EPTF1800XXXX

Configure the MAC Learning-limit under the VLAN or managed FortiSwitch ports view:

VLAN view:

config system interface edit vsw.aggr1 set switch-controller-learning-limit 10

next

end

Ports view:

config switch-controller managed-switch edit S248EPTF1800XXXX config ports edit port6 set learning-limit 11

next

end

next

end

Quarantine

When the FortiGate detects devices that have lower trust scores, lack mandatory installed software, or are sending out malicious traffic, an administrator can quarantine the device from the normal switch VLAN to the quarantine VLAN. This can limit the device’s access, or provide them specific information on the quarantine portal page.

To quarantine an active device:

Using the CLI, based on the device’s MAC address:

config user quarantine config targets edit “manual-qtn-1” set description “Manually quarantined” config macs edit 00:0c:29:d4:4f:3c

set description “manual-qtn ”

next

end

next

end

end

Using the GUI:

  1. On the FortiGate, go to Security Fabric > Physical Topology, or Security Fabric > Logical Topology.
  2. Mouse over the bubble of an active device, and select Quarantine Host from the right-click menu.
  3. Click OK in the Quarantine Host page to quarantine the device.

The quarantined device is moved to the quarantine VLAN, and the configuration of the FortiSwitch port does not change.

The quarantined device gets its IP address from the DHCP server on the quarantine VLAN interface. The network locations that the device can access depends on the firewall policies that are configured for the quarantine VLAN interface. By default, the device must acknowledge and accept the information on the Quarantine Portal before it can access any part of the network.

Release or clear the quarantine targets:

Using the CLI:

config user quarantine config targets delete “manual-qtn-1” …

end

end

config user quarantine config targets purge

end

end

Using the GUI:

  1. Go to Monitor> Quarantine Monitor.
  2. Delete the quarantine targets as needed, or click Remove All to delete all the targets.

Port-based 802.1X authentication

Port-based 802.1X authentication

This example show how to configure Port-based 802.1X authentication to managed FortiSwitch ports when using FortiLink. Managed FortiSwitch devices will authenticate user devices per each FortiSwitch port. If there is a hub after the FortiSwitch that connects multiple user devices to the same port, they can all access the network after authentication, which is not recommended from a security perspective.

Prerequisites:

l The certificates and authentication protocol supported by the supplicant software and RADIUS server are compatible. l The managed FortiSwitches using FortiLink act as authenticators.

Create a firewall policy to allow the RADIUS authentication related traffic from the Fortilink interface to the outbound interface on the FortiGate:

config firewall policy edit 0 set srcintf “fortilink-interface” set dstintf “outbound-interface-to-RadiusSVR”

set srcaddr “all” set dstaddr “all” set action accept set schedule “always” set service “RADIUS” set nat enable

next

end

Designate a RADIUS server and create a user group:

Using the CLI:

config user radius edit “Radius1”

set server “172.18.60.203” set secret ENC 1dddddd

next

end config user group edit “Radius-Grp1” set member “Radius1”

next

end

Using the GUI:

  1. On the FortiGate, go to User& Device > RADIUS Servers.
  2. Edit an existing server, or create a new one.
  3. If necessary, add a Name for the server.
  4. Set the IP/Name to 18.60.203 and Secret to 1dddddd .
  5. Configure other fields as necessary.
  6. Click OK.
  7. Go to User& Device > UserGroups.
  8. Create a new group, and add the RADIUS server to the Remote Groups
  9. Click OK.

Use the new user group in a security policy:

Using the CLI:

config switch-controller security-policy 802-1X edit “802-1X-policy-default” set security-mode 802.1X set user-group “Radius-Grp1” set mac-auth-bypass disable set open-auth disable set eap-passthru enable set guest-vlan disable set auth-fail-vlan disable set framevid-apply enable set radius-timeout-overwrite disable

next

end

Configure the guest VLAN, authentication fail VLAN, and other parameters as needed.

Using the GUI:

  1. Go to WiFi & Switch Controller> FortiSwitch Security Policies 2. Use the default 802-1X-policy-default, or create a new security policy.
  2. Use the RADIUS server group in the policy.
  3. Set the Security mode to Port-based.
  4. Configure other fields as necessary.
  5. Click OK.

Apply the security policy to the ports of the managed FortiSwitches:

Using the CLI:

config switch-controller managed-switch edit S248EPTF1800XXXX config ports edit “port6” set port-security-policy “802-1X-policy-default”

next

end

next

end

Using the GUI:

  1. On the FortiGate, go to WiFi & Switch Controller> FortiSwitch VLANs.
  2. Configure the VLAN interfaces that are applied on FortiSwitch.

On FortiGate, these switch VLAN interfaces are treated as layer-3 interfaces and are available to be applied by firewall policy and other security controls in FortiOS. This means that security boundary is extended to FortiSwitch.

Execute 802.1X authentication on a user device:

On Linux, run wpa_supplicant:

wpa_supplicant -c /etc/wpa_supplicant/local_supplicant.conf -D wired -i eth2 -dd On the FortiGate, view the status of the 802.1X authentication:

diagnose switch-controller switch-info 802.1X Managed Switch : S248EPTF18001384

port6 : Mode: port-based (mac-by-pass disable)

Link: Link up

Port State: authorized: ( )

Dynamic Authorized Vlan : 0

EAP pass-through mode : Enable

Native Vlan : 1

Allowed Vlan list: 1,4093 Untagged Vlan list: 4093 Guest VLAN :

Auth-Fail Vlan :

Sessions info:

00:0c:29:d4:4f:3c    Type=802.1x,MD5,state=AUTHENTICATED,etime=0,eap_cnt=6

params:reAuth=3600

MAC-based 802.1X authentication

MAC-based 802.1X authentication

This example show how to configure MAC-based 802.1X authentication to managed FortiSwitch ports when using FortiLink. Managed FortiSwitch devices will authenticate and record the MAC addresses of user devices. If there is a hub after the FortiSwitch that connects multiple user devices, each device can access the network after passing authentication.

Prerequisites:

  • The certificates and authentication protocol supported by the supplicant software and RADIUS server are compatible.
  • The managed FortiSwitches using FortiLink act as authenticators.

Create a firewall policy to allow the RADIUS authentication related traffic from the Fortilink interface to the outbound interface on the FortiGate:

config firewall policy edit 0 set srcintf “fortilink-interface” set dstintf “outbound-interface-to-RadiusSVR”

set srcaddr “all” set dstaddr “all” set action accept set schedule “always” set service “RADIUS” set nat enable

next

end

Designate a RADIUS server and create a user group:

Using the CLI:

config user radius edit “Radius1” set server “172.18.60.203” set secret ENC 1dddddd

next

end config user group edit “Radius-Grp1” set member “Radius1”

next

end

Using the GUI:

  1. On the FortiGate, go to User& Device > RADIUS Servers.
  2. Edit an existing server, or create a new one.
  3. If necessary, add a Name for the server.
  4. Set the IP/Name to 18.60.203 and Secret to 1dddddd .
  5. Configure other fields as necessary.
  6. Click OK.
  7. Go to User& Device > UserGroups.
  8. Create a new group, and add the RADIUS server to the Remote Groups
  9. Click OK.

Use the new user group in a security policy:

Using the CLI:

config switch-controller security-policy 802-1X edit “802-1X-policy-default” set security-mode 802.1X-mac-based set user-group “Radius-Grp1” set mac-auth-bypass disable set open-auth disable set eap-passthru enable set guest-vlan disable set auth-fail-vlan disable set framevid-apply enable set radius-timeout-overwrite disable

next

end

Configure the guest VLAN, authentication fail VLAN, and other parameters as needed.

Using the GUI:

  1. Go to WiFi & Switch Controller> FortiSwitch Security Policies 2. Use the default 802-1X-policy-default, or create a new security policy.
  2. Use the RADIUS server group in the policy.
  3. Set the Security mode to MAC-based.
  4. Configure other fields as necessary.
  5. Click OK.

Apply the security policy to the ports of the managed FortiSwitches:

Using the CLI:

config switch-controller managed-switch edit S248EPTF1800XXXX config ports edit “port6” set port-security-policy “802-1X-policy-default” next

end

next

end

On the FortiSwitch, check the configuration:

config switch interface edit “port6” set allowed-vlans 4093 set untagged-vlans 4093 set security-groups “Radius-Grp1”

set snmp-index 6 config port-security set auth-fail-vlan disable set eap-passthru enable set framevid-apply enable set guest-auth-delay 30 set guest-vlan disable set mac-auth-bypass disable set open-auth disable set port-security-mode 802.1X-mac-based set radius-timeout-overwrite disable set auth-fail-vlanid 200 set guest-vlanid 100

end

next

end

Using the GUI:

  1. On the FortiGate, go to WiFi & Switch Controller> FortiSwitch VLANs.
  2. Configure the VLAN interfaces that are applied on FortiSwitch.

On FortiGate, these switch VLAN interfaces are treated as layer-3 interfaces and are available to be applied by firewall policy and other security controls in FortiOS. This means that security boundary is extended to FortiSwitch.

Execute 802.1X authentication on a user device:

On Linux, run wpa_supplicant:

wpa_supplicant -c /etc/wpa_supplicant/local_supplicant.conf -D wired -i eth2 -dd
On the FortiGate, view the status of the 802.1X authentication:

diagnose switch-controller switch-info 802.1X Managed Switch : S248EPTF1800XXXX

 
port6 : Mode: mac-based (mac-by-pass disable) Link: Link up —–> MAC-based
Port State: authorized: ( )

passed. Otherwise, shown failed

EAP pass-through mode : Enable

Native Vlan : 1

Allowed Vlan list: 1,4093 Untagged Vlan list: 1,4093 Guest VLAN :

Auth-Fail Vlan :

—–> Showing authorized means auth
                                 Switch sessions 1/240,    Local port sessions:1/20

Client    MAC          Type    Vlan Dynamic-Vlan

00:0c:29:d4:4f:3c     802.1x      1      0            —–> User device of auth

passed can access the network. Its MAC address is recored, while other User Devices under same FSW ports still not allowed to access.

Sessions info:

00:0c:29:d4:4f:3c    Type=802.1x,MD5,state=AUTHENTICATED,etime=6,eap_cnt=3

params:reAuth=3600

Multiple FortiSwitches in tiers via aggregate interface with MCLAG enabled on all tiers

Multiple FortiSwitches in tiers via aggregate interface with MCLAG enabled on all tiers

This example provides a recommended configuration of FortiLink where multi-tier FortiSwitch devices are managed by an A-P mode HA cluster of FortiGates acting as a switch controller via an aggregate interface. The FortiGates provide AA links to two distribution FortiSwitches that are connected to each other by MCLAG. All access FortiSwitch devices have A-A links with two upper tier FortiSwitches, as long as the MCLAG-ICL has been enabled between the upper tiers.

Prerequisites:

  • The FortiGate model supports an aggregate interface. l FortiSwitch units have been upgraded to latest released software version.
  • Layer-3 path/route in the management VDOM is available to Internet so that the FortiSwitch units can synchronize NTP. l For the FortiSwitch D series, the models above 4 just support MCLAG. For the FortiSwitch E series, the models above 2 just support MCLAG.

Change the FortiSwitch management mode to FortiLink:

Enter the following CLI commands on the FortiSwitch:

config system global set switch-mgmt-mode fortilink

end

This operation will cleanup all of the configuration and reboot the system!

Do you want to continue? (y/n)y

Backing up local mode config before entering FortiLink mode….

If the FortiSwitch ports used for the FortiLink connection have auto-discovery-fortilink enabled, executing authorization on FortiGate will trigger the transformation to FortiLink mode automatically.

config switch interface

edit “port1” set auto-discovery-fortilink enable

…… next

end

Set up an A-P mode HA cluster:

See HA active-passive cluster setup on page 212.

Create an aggregate interface and designate it as Fortilink interface on the FortiGate:

Using the CLI:

config system interface edit “aggr1” set vdom “vdom1” set fortilink enable set type aggregate set member “port11” “port12”

set fortilink-split-interface disable

next

end fortilink-split-interface must be disabled for MCLAG to work.

Using the GUI:

  1. Go to WiFi & Switch Controller> FortiLink Interface.
  2. In Interface members, select one or more physical ports that are connected to different distribution FortiSwitches to create an aggregate interface.
  3. Disable FortiLink split interface.
  4. Configure other fields as necessary.
  5. Click OK.

Discover and authorize the FortiSwitch:

Using the CLI:

config switch-controller managed-switch edit “FSWSerialNum” set fsw-wan1-admin enable

…… next

end

Check the CLI output for Connection: Connected to show that FortiLink is up:

execute switch-controller get-conn-status FSWSerialNum

Get managed-switch S248EPTF18001384 connection status:

Admin Status: Authorized

Connection: Connected

Image Version: S248EP-v6.2.0-build143,190107 (Interim)

Remote Address: 2.2.2.2

Join Time: Fri Jan 11 15:22:32 2019

interface status duplex     speed fortilink stacking      poe status

port1 up full 1000Mbps no no Delivering Power port2 down N/A 0 no no Searching

…… Using the GUI:

  1. Go to WiFi & Switch Controller> Managed FortiSwitch.
  2. Click Authorize and wait for a few minutes for the connection to be established.

When FortiLink between the FortiGate and FortiSwitch is established, the Link-up ports change to green and the POE port that is supplying power changes to blue. The dotted line between the FortiGate and FortiSwitch changes to a solid line. The Connection status shows that FortiLink is up.

Enable MCLAG on the ICL link between the distribution FortiSwitch devices:

conf switch trunk edit “4DN4K15000008-0” set mclag-icl enable

next

end

When you enable mclag-icl, MCLAG on the FortiLink interface is enabled automatically and active-active backup links between the distribution FortiSwitches are established.

Extend the security perimeter to the edge of FortiSwitch:

  1. Configure the VLAN arrangement.
    1. On the FortiGate, go to WiFi & Switch Controller> FortiSwitch VLANs.
    2. Configure the VLAN interfaces that are applied on FortiSwitch.

On FortiGate, these switch VLAN interfaces are treated as layer-3 interfaces and are available to be applied by firewall policy and other security controls in FortiOS. This means that security boundary is extended to FortiSwitch.

  1. Configure FortiSwitch ports.
    1. On the FortiGate, go to WiFi & Switch Controller> FortiSwitch Ports.
    2. Select one or more FortiSwitch ports and assign them to the switch VLAN.
    3. You can also select POE/DHCP Snooping, STP, and other parameters for the FortiSwitch ports to show their real-time status such as link status, data statistics, etc.
  2. Configure access authentication.
    1. On the FortiGate, go to WiFi & Switch Controller> FortiSwitch Security Policies.
    2. Configure the 1X security policies.
    3. Select Port-based or MAC-based mode and select Usergroups from the existing VDOM.
    4. Configure other fields as necessary.
    5. Go to WiFi & Switch Controller> FortiSwitch Ports.
    6. Select one or more FortiSwitch ports, click + in the Security Policy column, then make a selection from the pane.

Troubleshooting

Authorized FortiSwitch always offline

If an authorized FortiSwitch is always offline, go to the FortiGate CLI and use the command below to see all the checkpoints. Inspect each checkpoint to find the cause of the problem. execute switch-controller diagnose-connection S248EPTF18001384

Fortilink interface … OK aggr1 enabled

DHCP server … OK aggr1 enabled

NTP server … OK aggr1 enabled NTP server sync … OK synchronized: yes, ntpsync: enabled, server-mode: enabled

ipv4 server(ntp1.fortiguard.com) 208.91.113.70 — reachable(0x80) S:2 T:128 no data

ipv4 server(ntp2.fortiguard.com) 208.91.113.71 — reachable(0x80) S:2 T:128 no data

ipv4 server(ntp2.fortiguard.com) 208.91.112.51 — reachable(0xff) S:2 T:66 selected server-version=4, stratum=2 reference time is dfe3aec5.744404e6 — UTC Sat Jan 12 00:09:41 2019 clock offset is -0.320411 sec, root delay is 0.054535 sec root dispersion is 0.533081 sec, peer dispersion is 11495 msec

ipv4 server(ntp1.fortiguard.com) 208.91.112.50 — reachable(0xff) S:2 T:66 server-version=4, stratum=2 reference time is dfe3aec5.744404e6 — UTC Sat Jan 12 00:09:41 2019 clock offset is -0.448087 sec, root delay is 0.054535 sec root dispersion is 0.533081 sec, peer dispersion is 12542 msec

HA mode … disabled

Fortilink

Status … SWITCH_AUTHORIZED_READY

Last keepalive … 1 seconds ago

CAPWAP

Remote Address: 2.2.2.2

Status … CONNECTED

Last keepalive … 26 seconds ago

PING 2.2.2.2 (2.2.2.2): 56 data bytes

64 bytes from 2.2.2.2: icmp_seq=0 ttl=64 time=1.1 ms

64 bytes from 2.2.2.2: icmp_seq=1 ttl=64 time=13.9 ms

64 bytes from 2.2.2.2: icmp_seq=2 ttl=64 time=12.7 ms

64 bytes from 2.2.2.2: icmp_seq=3 ttl=64 time=2.9 ms

64 bytes from 2.2.2.2: icmp_seq=4 ttl=64 time=1.2 ms

— 2.2.2.2 ping statistics —

5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 1.1/6.3/13.9 ms

HA sync fails

If HA sync fails, use the command below to diagnose and locate the cause.

# diagnose sys ha checksum cluster

================== FG5H0E39179XXX9 ==================

is_manage_master()=1, is_root_master()=1 debugzone

global: 2b e9 81 38 c2 9d 4f db b7 0e 1f 49 42 c6 1e fb vdom5: 3d dc e7 70 69 22 c3 12 a7 ac 68 06 21 21 ef 8f vdom3: 89 59 1f 45 7a 75 ae fc 71 bc 42 f4 5e c2 47 c8 vdom2: b2 a5 f3 e7 85 02 62 e5 2a 23 23 64 04 66 76 cc vdom1: 1f b5 11 61 31 c4 0c 72 2e 97 8d d8 45 7e d6 0c root: af a6 48 c5 c2 9a 8b 81 a5 53 fb 27 e9 ae 01 6a all: 89 1f 63 77 48 8a 30 ee 57 06 ca eb 71 e6 8e ad

checksum

global: 2b e9 81 38 c2 9d 4f db b7 0e 1f 49 42 c6 1e fb vdom5: 3d dc e7 70 69 22 c3 12 a7 ac 68 06 21 21 ef 8f vdom3: 89 59 1f 45 7a 75 ae fc 71 bc 42 f4 5e c2 47 c8 vdom2: b2 a5 f3 e7 85 02 62 e5 2a 23 23 64 04 66 76 cc vdom1: 1f b5 11 61 31 c4 0c 72 2e 97 8d d8 45 7e d6 0c root: af a6 48 c5 c2 9a 8b 81 a5 53 fb 27 e9 ae 01 6a all: 89 1f 63 77 48 8a 30 ee 57 06 ca eb 71 e6 8e ad

================== FG5H0E391790XXX4 ==================

is_manage_master()=0, is_root_master()=0 debugzone

global: 2b e9 81 38 c2 9d 4f db b7 0e 1f 49 42 c6 1e fb vdom5: 3d dc e7 70 69 22 c3 12 a7 ac 68 06 21 21 ef 8f vdom3: 89 59 1f 45 7a 75 ae fc 71 bc 42 f4 5e c2 47 c8 vdom2: b2 a5 f3 e7 85 02 62 e5 2a 23 23 64 04 66 76 cc vdom1: 1f b5 11 61 31 c4 0c 72 2e 97 8d d8 45 7e d6 0c root: af a6 48 c5 c2 9a 8b 81 a5 53 fb 27 e9 ae 01 6a all: 89 1f 63 77 48 8a 30 ee 57 06 ca eb 71 e6 8e ad

checksum

global: 2b e9 81 38 c2 9d 4f db b7 0e 1f 49 42 c6 1e fb vdom5: 3d dc e7 70 69 22 c3 12 a7 ac 68 06 21 21 ef 8f vdom3: 89 59 1f 45 7a 75 ae fc 71 bc 42 f4 5e c2 47 c8 vdom2: b2 a5 f3 e7 85 02 62 e5 2a 23 23 64 04 66 76 cc vdom1: 1f b5 11 61 31 c4 0c 72 2e 97 8d d8 45 7e d6 0c root: af a6 48 c5 c2 9a 8b 81 a5 53 fb 27 e9 ae 01 6a all: 89 1f 63 77 48 8a 30 ee 57 06 ca eb 71 e6 8e ad

Multiple FortiSwitches in tiers via aggregate interface with MCLAG enabled only on distribution

Multiple FortiSwitches in tiers via aggregate interface with MCLAG enabled only on distribution

This example provides a recommended configuration of FortiLink where multi-tier FortiSwitches are managed by an A-P mode HA cluster of FortiGates as switch controller via aggregate interface, where FortiGates provide active-active links to two distribution FortiSwitches connected to each other by MCLAG.

Prerequisites:

  • The FortiGate model supports an aggregate interface. l FortiSwitch units have been upgraded to latest released software version.
  • Layer-3 path/route in the management VDOM is available to Internet so that the FortiSwitch units can synchronize NTP.
  • For the FortiSwitch D series, the models above 4 just support MCLAG. For the FortiSwitch E series, the models above 2 just support MCLAG.

Change the FortiSwitch management mode to FortiLink:

Enter the following CLI commands on the FortiSwitch:

config system global set switch-mgmt-mode fortilink

end

This operation will cleanup all of the configuration and reboot the system!

Do you want to continue? (y/n)y

Backing up local mode config before entering FortiLink mode….

If the FortiSwitch ports used for the FortiLink connection have auto-discovery-fortilink enabled, executing authorization on FortiGate will trigger the transformation to FortiLink mode automatically.

config switch interface

edit “port1” set auto-discovery-fortilink enable ……

next

end

Set up an A-P mode HA cluster:

See HA active-passive cluster setup on page 212.

Create an aggregate interface and designate it as Fortilink interface on the FortiGate:

Using the CLI:

config system interface edit “aggr1” set vdom “vdom1” set fortilink enable set type aggregate set member “port11” “port12” set fortilink-split-interface disable

next

end fortilink-split-interface must be disabled for MCLAG to work.

Using the GUI:

  1. Go to WiFi & Switch Controller> FortiLink Interface.
  2. In Interface members, select one or more physical ports that are connected to different distribution FortiSwitches to create an aggregate interface.
  3. Disable FortiLink split interface.
  4. Configure other fields as necessary.
  5. Click OK.

Discover and authorize the FortiSwitch:

Using the CLI:

config switch-controller managed-switch edit “FSWSerialNum” set fsw-wan1-admin enable

…… next

end

Check the CLI output for Connection: Connected to show that FortiLink is up:

execute switch-controller get-conn-status FSWSerialNum

Get managed-switch S248EPTF18001384 connection status:

Admin Status: Authorized

Connection: Connected

Image Version: S248EP-v6.2.0-build143,190107 (Interim)

Remote Address: 2.2.2.2

Join Time: Fri Jan 11 15:22:32 2019

interface status duplex     speed fortilink stacking      poe status

port1       up     full 1000Mbps       no       no Delivering Power

port2     down      N/A     0           no       no         Searching

…… Using the GUI:

  1. Go to WiFi & Switch Controller> Managed FortiSwitch.
  2. Click Authorize and wait for a few minutes for the connection to be established.

When FortiLink between the FortiGate and FortiSwitch is established, the Link-up ports change to green and the POE port that is supplying power changes to blue. The dotted line between the FortiGate and FortiSwitch changes to a solid line. The Connection status shows that FortiLink is up.

Enable MCLAG on the ICL link between the distribution FortiSwitch devices:

conf switch trunk edit “4DN4K15000008-0” set mclag-icl enable

next

end

When you enable mclag-icl, MCLAG on the FortiLink interface is enabled automatically and active-active backup links between the distribution FortiSwitches are established.

Extend the security perimeter to the edge of FortiSwitch:

  1. Configure the VLAN arrangement.
    1. On the FortiGate, go to WiFi & Switch Controller> FortiSwitch VLANs.
    2. Configure the VLAN interfaces that are applied on FortiSwitch.

On FortiGate, these switch VLAN interfaces are treated as layer-3 interfaces and are available to be applied by firewall policy and other security controls in FortiOS. This means that security boundary is extended to FortiSwitch.

  1. Configure FortiSwitch ports.
    1. On the FortiGate, go to WiFi & Switch Controller> FortiSwitch Ports.
    2. Select one or more FortiSwitch ports and assign them to the switch VLAN.
    3. You can also select POE/DHCP Snooping, STP, and other parameters for the FortiSwitch ports to show their real-time status such as link status, data statistics, etc.
  2. Configure access authentication.
    1. On the FortiGate, go to WiFi & Switch Controller> FortiSwitch Security Policies.
    2. Configure the 1X security policies.
    3. Select Port-based or MAC-based mode and select Usergroups from the existing VDOM.
    4. Configure other fields as necessary.
    5. Go to WiFi & Switch Controller> FortiSwitch Ports.
    6. Select one or more FortiSwitch ports, click + in the Security Policy column, then make a selection from the pane.

Troubleshooting

Authorized FortiSwitch always offline

If an authorized FortiSwitch is always offline, go to the FortiGate CLI and use the command below to see all the checkpoints. Inspect each checkpoint to find the cause of the problem.

execute switch-controller diagnose-connection S248EPTF18001384

Fortilink interface … OK aggr1 enabled

DHCP server … OK aggr1 enabled

NTP server … OK aggr1 enabled NTP server sync … OK synchronized: yes, ntpsync: enabled, server-mode: enabled

ipv4 server(ntp1.fortiguard.com) 208.91.113.70 — reachable(0x80) S:2 T:128 no data

ipv4 server(ntp2.fortiguard.com) 208.91.113.71 — reachable(0x80) S:2 T:128 no data

ipv4 server(ntp2.fortiguard.com) 208.91.112.51 — reachable(0xff) S:2 T:66 selected server-version=4, stratum=2 reference time is dfe3aec5.744404e6 — UTC Sat Jan 12 00:09:41 2019 clock offset is -0.320411 sec, root delay is 0.054535 sec root dispersion is 0.533081 sec, peer dispersion is 11495 msec

ipv4 server(ntp1.fortiguard.com) 208.91.112.50 — reachable(0xff) S:2 T:66 server-version=4, stratum=2 reference time is dfe3aec5.744404e6 — UTC Sat Jan 12 00:09:41 2019 clock offset is -0.448087 sec, root delay is 0.054535 sec root dispersion is 0.533081 sec, peer dispersion is 12542 msec

HA mode … disabled

Fortilink

Status … SWITCH_AUTHORIZED_READY

Last keepalive … 1 seconds ago

CAPWAP

Remote Address: 2.2.2.2

Status … CONNECTED

Last keepalive … 26 seconds ago

PING 2.2.2.2 (2.2.2.2): 56 data bytes

64 bytes from 2.2.2.2: icmp_seq=0 ttl=64 time=1.1 ms

64 bytes from 2.2.2.2: icmp_seq=1 ttl=64 time=13.9 ms

64 bytes from 2.2.2.2: icmp_seq=2 ttl=64 time=12.7 ms

64 bytes from 2.2.2.2: icmp_seq=3 ttl=64 time=2.9 ms

64 bytes from 2.2.2.2: icmp_seq=4 ttl=64 time=1.2 ms

— 2.2.2.2 ping statistics —

5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 1.1/6.3/13.9 ms

HA sync fails

If HA sync fails, use the command below to diagnose and locate the cause.

# diagnose system ha checksum cluster

================== FG5H0E39179XXX9 ==================

is_manage_master()=1, is_root_master()=1 debugzone

global: 2b e9 81 38 c2 9d 4f db b7 0e 1f 49 42 c6 1e fb vdom5: 3d dc e7 70 69 22 c3 12 a7 ac 68 06 21 21 ef 8f vdom3: 89 59 1f 45 7a 75 ae fc 71 bc 42 f4 5e c2 47 c8 vdom2: b2 a5 f3 e7 85 02 62 e5 2a 23 23 64 04 66 76 cc vdom1: 1f b5 11 61 31 c4 0c 72 2e 97 8d d8 45 7e d6 0c root: af a6 48 c5 c2 9a 8b 81 a5 53 fb 27 e9 ae 01 6a all: 89 1f 63 77 48 8a 30 ee 57 06 ca eb 71 e6 8e ad

checksum

global: 2b e9 81 38 c2 9d 4f db b7 0e 1f 49 42 c6 1e fb vdom5: 3d dc e7 70 69 22 c3 12 a7 ac 68 06 21 21 ef 8f vdom3: 89 59 1f 45 7a 75 ae fc 71 bc 42 f4 5e c2 47 c8 vdom2: b2 a5 f3 e7 85 02 62 e5 2a 23 23 64 04 66 76 cc vdom1: 1f b5 11 61 31 c4 0c 72 2e 97 8d d8 45 7e d6 0c root: af a6 48 c5 c2 9a 8b 81 a5 53 fb 27 e9 ae 01 6a all: 89 1f 63 77 48 8a 30 ee 57 06 ca eb 71 e6 8e ad

================== FG5H0E391790XXX4 ==================

is_manage_master()=0, is_root_master()=0 debugzone

global: 2b e9 81 38 c2 9d 4f db b7 0e 1f 49 42 c6 1e fb vdom5: 3d dc e7 70 69 22 c3 12 a7 ac 68 06 21 21 ef 8f vdom3: 89 59 1f 45 7a 75 ae fc 71 bc 42 f4 5e c2 47 c8 vdom2: b2 a5 f3 e7 85 02 62 e5 2a 23 23 64 04 66 76 cc vdom1: 1f b5 11 61 31 c4 0c 72 2e 97 8d d8 45 7e d6 0c root: af a6 48 c5 c2 9a 8b 81 a5 53 fb 27 e9 ae 01 6a all: 89 1f 63 77 48 8a 30 ee 57 06 ca eb 71 e6 8e ad

checksum

global: 2b e9 81 38 c2 9d 4f db b7 0e 1f 49 42 c6 1e fb vdom5: 3d dc e7 70 69 22 c3 12 a7 ac 68 06 21 21 ef 8f vdom3: 89 59 1f 45 7a 75 ae fc 71 bc 42 f4 5e c2 47 c8 vdom2: b2 a5 f3 e7 85 02 62 e5 2a 23 23 64 04 66 76 cc vdom1: 1f b5 11 61 31 c4 0c 72 2e 97 8d d8 45 7e d6 0c root: af a6 48 c5 c2 9a 8b 81 a5 53 fb 27 e9 ae 01 6a all: 89 1f 63 77 48 8a 30 ee 57 06 ca eb 71 e6 8e ad

Multiple FortiSwitches in tiers via aggregate interface with redundant link enabled

Multiple FortiSwitches in tiers via aggregate interface with redundant link enabled

This example provides a recommended configuration of FortiLink where multi-tier FortiSwitches are managed by an A-P mode HA cluster of FortiGates as switch controller via aggregate interface, where each FortiGate cluster member can provide redundant links to multiple (>=2) distribution FortiSwitches.

Prerequisites:

  • The FortiGate model supports an aggregate interface. l FortiSwitch units have been upgraded to latest released software version.
  • Layer-3 path/route in the management VDOM is available to Internet so that the FortiSwitch units can synchronize NTP.

Change the FortiSwitch management mode to FortiLink:

Enter the following CLI commands on the FortiSwitch:

config system global set switch-mgmt-mode fortilink

end

This operation will cleanup all of the configuration and reboot the system!

Do you want to continue? (y/n)y

Backing up local mode config before entering FortiLink mode….

If the FortiSwitch ports used for the FortiLink connection have auto-discovery-fortilink enabled, executing authorization on FortiGate will trigger the transformation to FortiLink mode automatically.

config switch interface

edit “port1” set auto-discovery-fortilink enable

…… next

end

Set up an A-P mode HA cluster:

See HA active-passive cluster setup on page 212.

Create an aggregate interface and designate it as Fortilink interface on the FortiGate:

Using the CLI:

config system interface edit “aggr1” set vdom “vdom1” set fortilink enable set type aggregate set member “port11” “port12” set fortilink-split-interface enable

next

end

Using the GUI:

  1. Go to WiFi & Switch Controller> FortiLink Interface.
  2. In Interface members, select one or more physical ports that are connected to different distribution FortiSwitches to create an aggregate interface.
  3. Enable FortiLink split interface.
  4. Configure other fields as necessary.
  5. Click OK.

Discover and authorize the FortiSwitch:

Using the CLI:

config switch-controller managed-switch edit “FSWSerialNum” set fsw-wan1-admin enable

…… next

end

Check the CLI output for Connection: Connected to show that FortiLink is up:

execute switch-controller get-conn-status FSWSerialNum

Get managed-switch S248EPTF18001384 connection status:

Admin Status: Authorized

Connection: Connected

Image Version: S248EP-v6.2.0-build143,190107 (Interim)

Remote Address: 2.2.2.2

Join Time: Fri Jan 11 15:22:32 2019

interface status duplex     speed fortilink stacking      poe status

port1 up full 1000Mbps no no Delivering Power port2 down N/A 0 no no Searching

…… Using the GUI:

  1. Go to WiFi & Switch Controller> Managed FortiSwitch.
  2. Click Authorize and wait for a few minutes for the connection to be established.

When FortiLink between the FortiGate and FortiSwitch is established, the Link-up ports change to green and the POE port that is supplying power changes to blue. The dotted line between the FortiGate and FortiSwitch changes to a solid line. The Connection status shows that FortiLink is up.

Extend the security perimeter to the edge of FortiSwitch:

  1. Configure the VLAN arrangement.
    1. On the FortiGate, go to WiFi & Switch Controller> FortiSwitch VLANs.
    2. Configure the VLAN interfaces that are applied on FortiSwitch.

On FortiGate, these switch VLAN interfaces are treated as layer-3 interfaces and are available to be applied by firewall policy and other security controls in FortiOS. This means that security boundary is extended to FortiSwitch.

  1. Configure FortiSwitch ports.
    1. On the FortiGate, go to WiFi & Switch Controller> FortiSwitch Ports.
    2. Select one or more FortiSwitch ports and assign them to the switch VLAN.
    3. You can also select POE/DHCP Snooping, STP, and other parameters for the FortiSwitch ports to show their real-time status such as link status, data statistics, etc.
  2. Configure access authentication.
    1. On the FortiGate, go to WiFi & Switch Controller> FortiSwitch Security Policies.
    2. Configure the 1X security policies.
    3. Select Port-based or MAC-based mode and select Usergroups from the existing VDOM.
    4. Configure other fields as necessary.
    5. Go to WiFi & Switch Controller> FortiSwitch Ports.
    6. Select one or more FortiSwitch ports, click + in the Security Policy column, then make a selection from the pane.

Troubleshooting

Authorized FortiSwitch always offline

If an authorized FortiSwitch is always offline, go to the FortiGate CLI and use the command below to see all the checkpoints. Inspect each checkpoint to find the cause of the problem. execute switch-controller diagnose-connection S248EPTF18001384

Fortilink interface … OK aggr1 enabled

DHCP server … OK aggr1 enabled

NTP server … OK aggr1 enabled NTP server sync … OK synchronized: yes, ntpsync: enabled, server-mode: enabled

ipv4 server(ntp1.fortiguard.com) 208.91.113.70 — reachable(0x80) S:2 T:128 no data ipv4 server(ntp2.fortiguard.com) 208.91.113.71 — reachable(0x80) S:2 T:128 no data

ipv4 server(ntp2.fortiguard.com) 208.91.112.51 — reachable(0xff) S:2 T:66 selected server-version=4, stratum=2

reference time is dfe3aec5.744404e6 — UTC Sat Jan 12 00:09:41 2019 clock offset is -0.320411 sec, root delay is 0.054535 sec root dispersion is 0.533081 sec, peer dispersion is 11495 msec

ipv4 server(ntp1.fortiguard.com) 208.91.112.50 — reachable(0xff) S:2 T:66 server-version=4, stratum=2

reference time is dfe3aec5.744404e6 — UTC Sat Jan 12 00:09:41 2019 clock offset is -0.448087 sec, root delay is 0.054535 sec root dispersion is 0.533081 sec, peer dispersion is 12542 msec

HA mode … disabled

Fortilink

Status … SWITCH_AUTHORIZED_READY

Last keepalive … 1 seconds ago

CAPWAP

Remote Address: 2.2.2.2

Status … CONNECTED

Last keepalive … 26 seconds ago

PING 2.2.2.2 (2.2.2.2): 56 data bytes

64 bytes from 2.2.2.2: icmp_seq=0 ttl=64 time=1.1 ms

64 bytes from 2.2.2.2: icmp_seq=1 ttl=64 time=13.9 ms

64 bytes from 2.2.2.2: icmp_seq=2 ttl=64 time=12.7 ms

64 bytes from 2.2.2.2: icmp_seq=3 ttl=64 time=2.9 ms

64 bytes from 2.2.2.2: icmp_seq=4 ttl=64 time=1.2 ms

— 2.2.2.2 ping statistics —

5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 1.1/6.3/13.9 ms

HA sync fails

If HA sync fails, use the command below to diagnose and locate the cause.

# diagnose system ha checksum cluster

================== FG5H0E39179XXX9 ==================

is_manage_master()=1, is_root_master()=1 debugzone

global: 2b e9 81 38 c2 9d 4f db b7 0e 1f 49 42 c6 1e fb vdom5: 3d dc e7 70 69 22 c3 12 a7 ac 68 06 21 21 ef 8f vdom3: 89 59 1f 45 7a 75 ae fc 71 bc 42 f4 5e c2 47 c8 vdom2: b2 a5 f3 e7 85 02 62 e5 2a 23 23 64 04 66 76 cc vdom1: 1f b5 11 61 31 c4 0c 72 2e 97 8d d8 45 7e d6 0c root: af a6 48 c5 c2 9a 8b 81 a5 53 fb 27 e9 ae 01 6a all: 89 1f 63 77 48 8a 30 ee 57 06 ca eb 71 e6 8e ad

checksum

global: 2b e9 81 38 c2 9d 4f db b7 0e 1f 49 42 c6 1e fb vdom5: 3d dc e7 70 69 22 c3 12 a7 ac 68 06 21 21 ef 8f vdom3: 89 59 1f 45 7a 75 ae fc 71 bc 42 f4 5e c2 47 c8 vdom2: b2 a5 f3 e7 85 02 62 e5 2a 23 23 64 04 66 76 cc vdom1: 1f b5 11 61 31 c4 0c 72 2e 97 8d d8 45 7e d6 0c root: af a6 48 c5 c2 9a 8b 81 a5 53 fb 27 e9 ae 01 6a all: 89 1f 63 77 48 8a 30 ee 57 06 ca eb 71 e6 8e ad

================== FG5H0E391790XXX4 ==================

is_manage_master()=0, is_root_master()=0 debugzone

global: 2b e9 81 38 c2 9d 4f db b7 0e 1f 49 42 c6 1e fb vdom5: 3d dc e7 70 69 22 c3 12 a7 ac 68 06 21 21 ef 8f vdom3: 89 59 1f 45 7a 75 ae fc 71 bc 42 f4 5e c2 47 c8 vdom2: b2 a5 f3 e7 85 02 62 e5 2a 23 23 64 04 66 76 cc vdom1: 1f b5 11 61 31 c4 0c 72 2e 97 8d d8 45 7e d6 0c root: af a6 48 c5 c2 9a 8b 81 a5 53 fb 27 e9 ae 01 6a all: 89 1f 63 77 48 8a 30 ee 57 06 ca eb 71 e6 8e ad

checksum

global: 2b e9 81 38 c2 9d 4f db b7 0e 1f 49 42 c6 1e fb vdom5: 3d dc e7 70 69 22 c3 12 a7 ac 68 06 21 21 ef 8f vdom3: 89 59 1f 45 7a 75 ae fc 71 bc 42 f4 5e c2 47 c8 vdom2: b2 a5 f3 e7 85 02 62 e5 2a 23 23 64 04 66 76 cc vdom1: 1f b5 11 61 31 c4 0c 72 2e 97 8d d8 45 7e d6 0c root: af a6 48 c5 c2 9a 8b 81 a5 53 fb 27 e9 ae 01 6a all: 89 1f 63 77 48 8a 30 ee 57 06 ca eb 71 e6 8e ad

Multiple FortiSwitches managed via hardware/software switch

Multiple FortiSwitches managed via hardware/software switch

This example provides a recommended configuration of FortiLink where multiple FortiSwitches are managed by an A-P mode HA cluster of FortiGates as switch controller via hardware or software switch interface. An example of common usage is when you need multiple distribution FortiSwitches but lack supporting aggregate on the FortiGate pairs.

Prerequisites:

  • The FortiGate model supports hardware or software switch interface. l FortiSwitch units have been upgraded to latest released software version.
  • Layer-3 path/route in the management VDOM is available to Internet so that the FortiSwitch units can synchronize NTP.

Change the FortiSwitch management mode to FortiLink:

Enter the following CLI commands on the FortiSwitch:

config system global set switch-mgmt-mode fortilink

end

This operation will cleanup all of the configuration and reboot the system!

Do you want to continue? (y/n)y

Backing up local mode config before entering FortiLink mode….

If the FortiSwitch ports used for the FortiLink connection have auto-discovery-fortilink enabled, executing authorization on FortiGate will trigger the transformation to FortiLink mode automatically.

config switch interface

edit “port1” set auto-discovery-fortilink enable

…… next

end

Set up an A-P mode HA cluster:

See HA active-passive cluster setup on page 212.

Create hardware or software switch interface and designate it as FortiLink interface on the FortiGate:

Create a hardware switch using the CLI:

config system virtual-switch edit “hardswitch1” set physical-switch “sw0” config port edit “port11” next edit “port12” next

end

next

end

Create a software switch using the CLI:

config system switch-interface edit “softswitch1” set vdom “vdom1” set member “port11” “port12”

next

end

Using the GUI:

  1. Go to WiFi & Switch Controller> FortiLink Interface.
  2. In Interface members, select an existing hardware/software switch interface (if there is one) or select one or more physical ports to create a hardware/software switch interface.
  3. Configure other fields as necessary.
  4. Click OK.

Discover and authorize the FortiSwitch:

Using the CLI:

config switch-controller managed-switch edit “FSWSerialNum” set fsw-wan1-admin enable

…… next

end

Check the CLI output for Connection: Connected to show that FortiLink is up:

execute switch-controller get-conn-status FSWSerialNum

Get managed-switch S248EPTF18001384 connection status:

Admin Status: Authorized

Connection: Connected

Image Version: S248EP-v6.2.0-build143,190107 (Interim)

Remote Address: 2.2.2.2

Join Time: Fri Jan 11 15:22:32 2019

interface status duplex     speed fortilink stacking      poe status

port1       up     full 1000Mbps       no       no Delivering Power

port2     down      N/A     0           no       no         Searching

…… Using the GUI:

  1. Go to WiFi & Switch Controller> Managed FortiSwitch.
  2. Click Authorize and wait for a few minutes for the connection to be established.

When FortiLink between the FortiGate and FortiSwitch is established, the Link-up ports change to green and the POE port that is supplying power changes to blue. The dotted line between the FortiGate and FortiSwitch changes to a solid line. The Connection status shows that FortiLink is up.

Extend the security perimeter to the edge of FortiSwitch:

  1. Configure the VLAN arrangement.
    1. On the FortiGate, go to WiFi & Switch Controller> FortiSwitch VLANs.
    2. Configure the VLAN interfaces that are applied on FortiSwitch.

On FortiGate, these switch VLAN interfaces are treated as layer-3 interfaces and are available to be applied by firewall policy and other security controls in FortiOS. This means that security boundary is extended to FortiSwitch.

  1. Configure FortiSwitch ports.
    1. On the FortiGate, go to WiFi & Switch Controller> FortiSwitch Ports.
    2. Select one or more FortiSwitch ports and assign them to the switch VLAN.
    3. You can also select POE/DHCP Snooping, STP, and other parameters for the FortiSwitch ports to show their real-time status such as link status, data statistics, etc.
  2. Configure access authentication.
    1. On the FortiGate, go to WiFi & Switch Controller> FortiSwitch Security Policies.
    2. Configure the 1X security policies.
    3. Select Port-based or MAC-based mode and select Usergroups from the existing VDOM.
    4. Configure other fields as necessary.
    5. Go to WiFi & Switch Controller> FortiSwitch Ports.
    6. Select one or more FortiSwitch ports, click + in the Security Policy column, then make a selection from the pane.

Troubleshooting

Bind FortiLink on hardware switch interface

Fortinet recommends binding FortiLink on the hardware switch interface. Since the hardware switch interface can leverage hardware chips to forward traffic, it does not consume CPU capacity, unlike a software switch.

Authorized FortiSwitch always offline

If an authorized FortiSwitch is always offline, go to the FortiGate CLI and use the command below to see all the checkpoints. Inspect each checkpoint to find the cause of the problem. execute switch-controller diagnose-connection S248EPTF18001384

Fortilink interface … OK hardswitch1 enabled

DHCP server … OK hardswitch1 enabled

NTP server … OK hardswitch1 enabled NTP server sync … OK synchronized: yes, ntpsync: enabled, server-mode: enabled

ipv4 server(ntp1.fortiguard.com) 208.91.113.70 — reachable(0x80) S:2 T:128 no data

ipv4 server(ntp2.fortiguard.com) 208.91.113.71 — reachable(0x80) S:2 T:128 no data

ipv4 server(ntp2.fortiguard.com) 208.91.112.51 — reachable(0xff) S:2 T:66 selected server-version=4, stratum=2 reference time is dfe3aec5.744404e6 — UTC Sat Jan 12 00:09:41 2019 clock offset is -0.320411 sec, root delay is 0.054535 sec root dispersion is 0.533081 sec, peer dispersion is 11495 msec

ipv4 server(ntp1.fortiguard.com) 208.91.112.50 — reachable(0xff) S:2 T:66 server-version=4, stratum=2 reference time is dfe3aec5.744404e6 — UTC Sat Jan 12 00:09:41 2019 clock offset is -0.448087 sec, root delay is 0.054535 sec root dispersion is 0.533081 sec, peer dispersion is 12542 msec

HA mode … disabled

Fortilink

Status … SWITCH_AUTHORIZED_READY

Last keepalive … 1 seconds ago

CAPWAP

Remote Address: 2.2.2.2

Status … CONNECTED

Last keepalive … 26 seconds ago

PING 2.2.2.2 (2.2.2.2): 56 data bytes

64 bytes from 2.2.2.2: icmp_seq=0 ttl=64 time=1.1 ms

64 bytes from 2.2.2.2: icmp_seq=1 ttl=64 time=13.9 ms

64 bytes from 2.2.2.2: icmp_seq=2 ttl=64 time=12.7 ms

64 bytes from 2.2.2.2: icmp_seq=3 ttl=64 time=2.9 ms

64 bytes from 2.2.2.2: icmp_seq=4 ttl=64 time=1.2 ms

— 2.2.2.2 ping statistics —

5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 1.1/6.3/13.9 ms

HA sync fails

If HA sync fails, use the command below to diagnose and locate the cause.

# diagnose system ha checksum cluster

================== FG5H0E39179XXX9 ==================

is_manage_master()=1, is_root_master()=1 debugzone

global: 2b e9 81 38 c2 9d 4f db b7 0e 1f 49 42 c6 1e fb vdom5: 3d dc e7 70 69 22 c3 12 a7 ac 68 06 21 21 ef 8f vdom3: 89 59 1f 45 7a 75 ae fc 71 bc 42 f4 5e c2 47 c8 vdom2: b2 a5 f3 e7 85 02 62 e5 2a 23 23 64 04 66 76 cc vdom1: 1f b5 11 61 31 c4 0c 72 2e 97 8d d8 45 7e d6 0c root: af a6 48 c5 c2 9a 8b 81 a5 53 fb 27 e9 ae 01 6a all: 89 1f 63 77 48 8a 30 ee 57 06 ca eb 71 e6 8e ad

checksum

global: 2b e9 81 38 c2 9d 4f db b7 0e 1f 49 42 c6 1e fb vdom5: 3d dc e7 70 69 22 c3 12 a7 ac 68 06 21 21 ef 8f vdom3: 89 59 1f 45 7a 75 ae fc 71 bc 42 f4 5e c2 47 c8 vdom2: b2 a5 f3 e7 85 02 62 e5 2a 23 23 64 04 66 76 cc vdom1: 1f b5 11 61 31 c4 0c 72 2e 97 8d d8 45 7e d6 0c root: af a6 48 c5 c2 9a 8b 81 a5 53 fb 27 e9 ae 01 6a all: 89 1f 63 77 48 8a 30 ee 57 06 ca eb 71 e6 8e ad

================== FG5H0E391790XXX4 ==================

is_manage_master()=0, is_root_master()=0 debugzone

global: 2b e9 81 38 c2 9d 4f db b7 0e 1f 49 42 c6 1e fb vdom5: 3d dc e7 70 69 22 c3 12 a7 ac 68 06 21 21 ef 8f vdom3: 89 59 1f 45 7a 75 ae fc 71 bc 42 f4 5e c2 47 c8 vdom2: b2 a5 f3 e7 85 02 62 e5 2a 23 23 64 04 66 76 cc vdom1: 1f b5 11 61 31 c4 0c 72 2e 97 8d d8 45 7e d6 0c root: af a6 48 c5 c2 9a 8b 81 a5 53 fb 27 e9 ae 01 6a all: 89 1f 63 77 48 8a 30 ee 57 06 ca eb 71 e6 8e ad

checksum

global: 2b e9 81 38 c2 9d 4f db b7 0e 1f 49 42 c6 1e fb vdom5: 3d dc e7 70 69 22 c3 12 a7 ac 68 06 21 21 ef 8f vdom3: 89 59 1f 45 7a 75 ae fc 71 bc 42 f4 5e c2 47 c8 vdom2: b2 a5 f3 e7 85 02 62 e5 2a 23 23 64 04 66 76 cc vdom1: 1f b5 11 61 31 c4 0c 72 2e 97 8d d8 45 7e d6 0c root: af a6 48 c5 c2 9a 8b 81 a5 53 fb 27 e9 ae 01 6a all: 89 1f 63 77 48 8a 30 ee 57 06 ca eb 71 e6 8e ad

Multiple FortiSwitches in tiers via aggregate interface with MCLAG enabled only on distribution

Multiple FortiSwitches in tiers via aggregate interface with MCLAG enabled only on distribution

This example provides a recommended configuration of FortiLink where multi-tier FortiSwitches are managed by a standalone FortiGate as switch controller via aggregate interface, where the FortiGate can provide active-active links to two distribution FortiSwitches connected to each other by MCLAG.

Prerequisites:

  • The FortiGate model supports an aggregate interface. l FortiSwitch units have been upgraded to latest released software version.
  • Layer-3 path/route in the management VDOM is available to Internet so that the FortiSwitch units can synchronize NTP.
  • For the FortiSwitch D series, the models above 4 just support MCLAG. For the FortiSwitch E series, the models above 2 just support MCLAG.

Change the FortiSwitch management mode to FortiLink:

Enter the following CLI commands on the FortiSwitch:

config system global set switch-mgmt-mode fortilink

end

This operation will cleanup all of the configuration and reboot the system!

Do you want to continue? (y/n)y

Backing up local mode config before entering FortiLink mode….

If the FortiSwitch ports used for the FortiLink connection have auto-discovery-fortilink enabled, executing authorization on FortiGate will trigger the transformation to FortiLink mode automatically.

config switch interface

edit “port1” set auto-discovery-fortilink enable ……

next

end

Create an aggregate interface and designate it as Fortilink interface on the FortiGate:

Using the CLI:

config system interface edit “aggr1” set vdom “vdom1” set fortilink enable set type aggregate set member “port11” “port12” set fortilink-split-interface disable

next

end fortilink-split-interface must be disabled for MCLAG to work.

Using the GUI:

  1. Go to WiFi & Switch Controller> FortiLink Interface.
  2. In Interface members, select one or more physical ports that are connected to different distribution FortiSwitches to create an aggregate interface.
  3. Disable FortiLink split interface.
  4. Configure other fields as necessary.
  5. Click OK.

Discover and authorize the FortiSwitch:

Using the CLI:

config switch-controller managed-switch edit “FSWSerialNum” set fsw-wan1-admin enable

…… next

end

Check the CLI output for Connection: Connected to show that FortiLink is up:

execute switch-controller get-conn-status FSWSerialNum

Get managed-switch S248EPTF18001384 connection status:

Admin Status: Authorized

Connection: Connected

Image Version: S248EP-v6.2.0-build143,190107 (Interim)

Remote Address: 2.2.2.2

Join Time: Fri Jan 11 15:22:32 2019

interface status duplex     speed fortilink stacking      poe status

port1 up full 1000Mbps no no Delivering Power port2 down N/A 0 no no Searching

…… Using the GUI:

  1. Go to WiFi & Switch Controller> Managed FortiSwitch.
  2. Click Authorize and wait for a few minutes for the connection to be established.

When FortiLink between the FortiGate and FortiSwitch is established, the Link-up ports change to green and the POE port that is supplying power changes to blue. The dotted line between the FortiGate and FortiSwitch changes to a solid line. The Connection status shows that FortiLink is up.

Enable MCLAG on the ICL link between the distribution FortiSwitch devices:

conf switch trunk edit “4DN4K15000008-0” set mclag-icl enable

next

end

When you enable mclag-icl, MCLAG on the FortiLink interface is enabled automatically and active-active backup links between the distribution FortiSwitches are established.

Extend the security perimeter to the edge of FortiSwitch:

  1. Configure the VLAN arrangement.
    1. On the FortiGate, go to WiFi & Switch Controller> FortiSwitch VLANs.
    2. Configure the VLAN interfaces that are applied on FortiSwitch.

On FortiGate, these switch VLAN interfaces are treated as layer-3 interfaces and are available to be applied by firewall policy and other security controls in FortiOS. This means that security boundary is extended to FortiSwitch.

  1. Configure FortiSwitch ports.
    1. On the FortiGate, go to WiFi & Switch Controller> FortiSwitch Ports.
    2. Select one or more FortiSwitch ports and assign them to the switch VLAN.
    3. You can also select POE/DHCP Snooping, STP, and other parameters for the FortiSwitch ports to show their real-time status such as link status, data statistics, etc.
  2. Configure access authentication.
    1. On the FortiGate, go to WiFi & Switch Controller> FortiSwitch Security Policies.
    2. Configure the 1X security policies.
    3. Select Port-based or MAC-based mode and select Usergroups from the existing VDOM.
    4. Configure other fields as necessary.
    5. Go to WiFi & Switch Controller> FortiSwitch Ports.
    6. Select one or more FortiSwitch ports, click + in the Security Policy column, then make a selection from the pane.

Troubleshooting

Authorized FortiSwitch always offline

If an authorized FortiSwitch is always offline, go to the FortiGate CLI and use the command below to see all the checkpoints. Inspect each checkpoint to find the cause of the problem.

execute switch-controller diagnose-connection S248EPTF18001384

Fortilink interface … OK aggr1 enabled

DHCP server … OK aggr1 enabled

NTP server … OK aggr1 enabled NTP server sync … OK synchronized: yes, ntpsync: enabled, server-mode: enabled

ipv4 server(ntp1.fortiguard.com) 208.91.113.70 — reachable(0x80) S:2 T:128 no data ipv4 server(ntp2.fortiguard.com) 208.91.113.71 — reachable(0x80) S:2 T:128 no data ipv4 server(ntp2.fortiguard.com) 208.91.112.51 — reachable(0xff) S:2 T:66 selected server-version=4, stratum=2

reference time is dfe3aec5.744404e6 — UTC Sat Jan 12 00:09:41 2019 clock offset is -0.320411 sec, root delay is 0.054535 sec root dispersion is 0.533081 sec, peer dispersion is 11495 msec

ipv4 server(ntp1.fortiguard.com) 208.91.112.50 — reachable(0xff) S:2 T:66 server-version=4, stratum=2

reference time is dfe3aec5.744404e6 — UTC Sat Jan 12 00:09:41 2019 clock offset is -0.448087 sec, root delay is 0.054535 sec root dispersion is 0.533081 sec, peer dispersion is 12542 msec

HA mode … disabled

Fortilink

Status … SWITCH_AUTHORIZED_READY

Last keepalive … 1 seconds ago

CAPWAP

Remote Address: 2.2.2.2

Status … CONNECTED

Last keepalive … 26 seconds ago

PING 2.2.2.2 (2.2.2.2): 56 data bytes

64 bytes from 2.2.2.2: icmp_seq=0 ttl=64 time=1.1 ms

64 bytes from 2.2.2.2: icmp_seq=1 ttl=64 time=13.9 ms

64 bytes from 2.2.2.2: icmp_seq=2 ttl=64 time=12.7 ms

64 bytes from 2.2.2.2: icmp_seq=3 ttl=64 time=2.9 ms

64 bytes from 2.2.2.2: icmp_seq=4 ttl=64 time=1.2 ms

— 2.2.2.2 ping statistics —

5 packets transmitted, 5 packets received, 0% packet loss round-trip min/avg/max = 1.1/6.3/13.9 ms