Fortinet black logo

Session-Aware Load Balancing Cluster Guide

AP mode SLBC HA with LAGs third-party switch example

5.2.10
Copy Link
Copy Doc ID 31a89d05-200d-11e9-b6f6-f8bc1258b856:791702
Download PDF

AP mode SLBC HA with LAGs third-party switch example

This example shows how to configure a single Cisco Nexus 3000 switch to provide redundant connections for LACP LAGs in an AP mode SLBC HA cluster.

The cluster includes two FortiGate-5000 chassis. Each chassis has two FortiController-5903Cs in slots 1 and 2 operating in AP FortiController mode and two FortiGate-5000 workers in slots 3 and 4. The primary FortiController-5903C in chassis 1 slot 1 is configured with two LACP groups. One LACP group contains the F1 and F2 interfaces, the other LACP group contains the F3 and F4 interfaces. These LACP groups are synchronized to the secondary FortiController-5903C in slot 2 and to the primary and secondary FortiController-5903Cs in chassis 2.

The Cisco Nexus 3000 switch requires two LACP groups for each FortiController, for a total of 8 LACP groups. To support redundancy, the LACP groups that connect the F1 and F2 interfaces of all the FortiControllers are on one VLAN (in the example, 301) and the LACP groups that include the F3 and F4 interfaces are on another VLAN (in the example, 302).

To set up the configuration:

  1. Log in to the CLI of the primary FortiController (in chassis 1 slot 1) and enter the following command to create two trunks.

    config switch fabric-channel trunk

    edit "trunk01"

    set mode lacp-active

    set members f1-1 f1-2

    next

    edit "trunk02"

    set mode lacp-active

    set members f1-3 f1-4

    end

    The trunks are synchronized to all of the FortiControllers in the cluster.

  2. Log into the CLI of the primary worker and enter the following command to add two FortiController trunk interfaces. These match the trunks added to the FortiControllers:

    config system interface

    edit "fctrl1/trunk01"

    set vdom "root"

    set ip 11.0.0.1 255.0.0.0

    set type fctrl-trunk

    set member fctrl1/f1 fctrl1/f2

    next

    edit "fctrl1/trunk02"

    set vdom "root"

    set ip 12.0.0.1 255.0.0.0

    set type fctrl-trunk

    set member fctrl1/f3 fctrl1/f4

    end

    The trunk interfaces are synchronized to all of the workers in the cluster.

  3. Log into the Cisco nexus 3000 switch CLI.

  4. Configure eight port channels, one for each FortiController LACP group:

    interface port-channel301

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    interface port-channel302

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    interface port-channel3011

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    interface port-channel3022

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    interface port-channel401

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    interface port-channel402

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    interface port-channel4011

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    interface port-channel4022

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

  5. Configure the switch interfaces (31 to 34) for the chassis 1 slot 1 trunks.

    interface Ethernet1/31

    description c1s1 f1

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 301 mode active

    interface Ethernet1/32

    description c1s1 f2

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 301 mode active

    interface Ethernet1/33

    description c1s1 f3

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 302 mode active

    interface Ethernet1/34

    description c1s1 f4

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 302 mode active

  6. Configure the switch interfaces (41 to 44) for the chassis 1 slot 2 trunks.

    interface Ethernet1/41

    description c1s2 f1

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 3011 mode active

    interface Ethernet1/42

    description c1s2 f2

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 3011 mode active

    interface Ethernet1/43

    description c1s2 f3

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 3022 mode active

    interface Ethernet1/44

    description c1s2 f4

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 3022 mode active

  7. Configure the switch interfaces (51 to 54) for the chassis 2 slot 1 trunks.

    interface Ethernet1/51

    description c2s1 f1

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 401 mode active

    channel-group 301 mode active

    interface Ethernet1/52

    description c2s1 f2

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 401 mode active

    interface Ethernet1/53

    description c2s1 f3

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 402 mode active

    interface Ethernet1/54

    description c2s2 f4

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 402 mode active

  8. Configure the switch interfaces (61 to 64) for the chassis 2 slot 2 trunks.

    interface Ethernet1/61

    description c2s2 f1

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 4011 mode active

    interface Ethernet1/62

    description c2s2 f2

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 4011 mode active

    interface Ethernet1/63

    description c2s2 f3

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 4022 mode active

    interface Ethernet1/64

    description c2s2 f4

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 4022 mode active

AP mode SLBC HA with LAGs third-party switch example

This example shows how to configure a single Cisco Nexus 3000 switch to provide redundant connections for LACP LAGs in an AP mode SLBC HA cluster.

The cluster includes two FortiGate-5000 chassis. Each chassis has two FortiController-5903Cs in slots 1 and 2 operating in AP FortiController mode and two FortiGate-5000 workers in slots 3 and 4. The primary FortiController-5903C in chassis 1 slot 1 is configured with two LACP groups. One LACP group contains the F1 and F2 interfaces, the other LACP group contains the F3 and F4 interfaces. These LACP groups are synchronized to the secondary FortiController-5903C in slot 2 and to the primary and secondary FortiController-5903Cs in chassis 2.

The Cisco Nexus 3000 switch requires two LACP groups for each FortiController, for a total of 8 LACP groups. To support redundancy, the LACP groups that connect the F1 and F2 interfaces of all the FortiControllers are on one VLAN (in the example, 301) and the LACP groups that include the F3 and F4 interfaces are on another VLAN (in the example, 302).

To set up the configuration:

  1. Log in to the CLI of the primary FortiController (in chassis 1 slot 1) and enter the following command to create two trunks.

    config switch fabric-channel trunk

    edit "trunk01"

    set mode lacp-active

    set members f1-1 f1-2

    next

    edit "trunk02"

    set mode lacp-active

    set members f1-3 f1-4

    end

    The trunks are synchronized to all of the FortiControllers in the cluster.

  2. Log into the CLI of the primary worker and enter the following command to add two FortiController trunk interfaces. These match the trunks added to the FortiControllers:

    config system interface

    edit "fctrl1/trunk01"

    set vdom "root"

    set ip 11.0.0.1 255.0.0.0

    set type fctrl-trunk

    set member fctrl1/f1 fctrl1/f2

    next

    edit "fctrl1/trunk02"

    set vdom "root"

    set ip 12.0.0.1 255.0.0.0

    set type fctrl-trunk

    set member fctrl1/f3 fctrl1/f4

    end

    The trunk interfaces are synchronized to all of the workers in the cluster.

  3. Log into the Cisco nexus 3000 switch CLI.

  4. Configure eight port channels, one for each FortiController LACP group:

    interface port-channel301

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    interface port-channel302

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    interface port-channel3011

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    interface port-channel3022

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    interface port-channel401

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    interface port-channel402

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    interface port-channel4011

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    interface port-channel4022

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

  5. Configure the switch interfaces (31 to 34) for the chassis 1 slot 1 trunks.

    interface Ethernet1/31

    description c1s1 f1

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 301 mode active

    interface Ethernet1/32

    description c1s1 f2

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 301 mode active

    interface Ethernet1/33

    description c1s1 f3

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 302 mode active

    interface Ethernet1/34

    description c1s1 f4

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 302 mode active

  6. Configure the switch interfaces (41 to 44) for the chassis 1 slot 2 trunks.

    interface Ethernet1/41

    description c1s2 f1

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 3011 mode active

    interface Ethernet1/42

    description c1s2 f2

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 3011 mode active

    interface Ethernet1/43

    description c1s2 f3

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 3022 mode active

    interface Ethernet1/44

    description c1s2 f4

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 3022 mode active

  7. Configure the switch interfaces (51 to 54) for the chassis 2 slot 1 trunks.

    interface Ethernet1/51

    description c2s1 f1

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 401 mode active

    channel-group 301 mode active

    interface Ethernet1/52

    description c2s1 f2

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 401 mode active

    interface Ethernet1/53

    description c2s1 f3

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 402 mode active

    interface Ethernet1/54

    description c2s2 f4

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 402 mode active

  8. Configure the switch interfaces (61 to 64) for the chassis 2 slot 2 trunks.

    interface Ethernet1/61

    description c2s2 f1

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 4011 mode active

    interface Ethernet1/62

    description c2s2 f2

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 4011 mode active

    interface Ethernet1/63

    description c2s2 f3

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 4022 mode active

    interface Ethernet1/64

    description c2s2 f4

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 4022 mode active