Fortinet black logo

Session-Aware Load Balancing Cluster Guide

Dual mode SLBC HA with LAGs third-party switch example

5.2.10
Copy Link
Copy Doc ID 31a89d05-200d-11e9-b6f6-f8bc1258b856:897839
Download PDF

Dual mode SLBC HA with LAGs third-party switch example

This example shows how to configure a single Cisco Nexus 3000 switch to provide redundant connections for the LACP LAGs in a dual mode SLBC HA cluster.

The cluster includes two FortiGate-5000 chassis. Each chassis has two FortiController-5903Cs in slots 1 and 2 operating in dual FortiController mode and two FortiGate-5000 workers in slots 3 and 4. Each dual mode FortiController-5903C is configured with an LACP group that includes the F1 and F2 interfaces. So each chassis has two LACP groups.

The Cisco Nexus 3000 switch requires four LACP groups, one for each of the FortiController LACP groups. To support redundancy, the LACP groups on the switch for the FortiControllers in chassis 1 slot 1 and chassis 3 slot 1 are on one VLAN (in the example, 301) and the LACP groups on the switch for the FortiControllers in chassis 1 slot 2 and chassis 2 slot 2 are on another VLAN (in the example, 302).

To set up the configuration:

  1. Log in to the CLI of each FortiController and enter the following command to create a trunk that includes the F1 and F2 interfaces. In this example, each FortiController has the same trunk configuration.

    config switch fabric-channel trunk

    edit "trunk01"

    set mode lacp-active

    set members f1-1 f1-2

    end

  2. Log into the CLI of the primary worker and enter the following command to add two FortiController trunk interfaces. These match the trunks added to the FortiControllers:

    config system interface

    edit "fctrl1/trunk01"

    set vdom "root"

    set ip 11.0.0.1 255.0.0.0

    set type fctrl-trunk

    set member fctrl1/f1 fctrl1/f2

    next

    edit "fctrl2/trunk01"

    set vdom "root"

    set ip 12.0.0.1 255.0.0.0

    set type fctrl-trunk

    set member fctrl2/f1 fctrl2/f2

    end

  3. Log into the Cisco nexus 3000 switch CLI.

  4. Configure four port channels, one for each FortiController LAG:

    interface port-channel301

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    interface port-channel302

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    interface port-channel3011

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    interface port-channel3022

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

  5. Configure the switch interfaces (31 to 34) for the chassis 1 trunks.

    interface Ethernet1/31

    description c1s1 f1-1

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 301 mode active

    interface Ethernet1/32

    description c1s1 f1-2

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 301 mode active

    interface Ethernet1/33

    description c1s2 f1-1

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 302 mode active

    interface Ethernet1/34

    description c1s2 f1-2

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 302 mode active

  6. Configure the switch interfaces (41 to 44) for the chassis 2 trunks.

    interface Ethernet1/41

    description c2s1 f1-1

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 3011 mode active

    interface Ethernet1/42

    description c2s1 f1-2

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 3011 mode active

    interface Ethernet1/43

    description c2s2 f1-1

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 3022 mode active

    interface Ethernet1/44

    description c2s2 f1-2

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 3022 mode active

Dual mode SLBC HA with LAGs third-party switch example

This example shows how to configure a single Cisco Nexus 3000 switch to provide redundant connections for the LACP LAGs in a dual mode SLBC HA cluster.

The cluster includes two FortiGate-5000 chassis. Each chassis has two FortiController-5903Cs in slots 1 and 2 operating in dual FortiController mode and two FortiGate-5000 workers in slots 3 and 4. Each dual mode FortiController-5903C is configured with an LACP group that includes the F1 and F2 interfaces. So each chassis has two LACP groups.

The Cisco Nexus 3000 switch requires four LACP groups, one for each of the FortiController LACP groups. To support redundancy, the LACP groups on the switch for the FortiControllers in chassis 1 slot 1 and chassis 3 slot 1 are on one VLAN (in the example, 301) and the LACP groups on the switch for the FortiControllers in chassis 1 slot 2 and chassis 2 slot 2 are on another VLAN (in the example, 302).

To set up the configuration:

  1. Log in to the CLI of each FortiController and enter the following command to create a trunk that includes the F1 and F2 interfaces. In this example, each FortiController has the same trunk configuration.

    config switch fabric-channel trunk

    edit "trunk01"

    set mode lacp-active

    set members f1-1 f1-2

    end

  2. Log into the CLI of the primary worker and enter the following command to add two FortiController trunk interfaces. These match the trunks added to the FortiControllers:

    config system interface

    edit "fctrl1/trunk01"

    set vdom "root"

    set ip 11.0.0.1 255.0.0.0

    set type fctrl-trunk

    set member fctrl1/f1 fctrl1/f2

    next

    edit "fctrl2/trunk01"

    set vdom "root"

    set ip 12.0.0.1 255.0.0.0

    set type fctrl-trunk

    set member fctrl2/f1 fctrl2/f2

    end

  3. Log into the Cisco nexus 3000 switch CLI.

  4. Configure four port channels, one for each FortiController LAG:

    interface port-channel301

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    interface port-channel302

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    interface port-channel3011

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    interface port-channel3022

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

  5. Configure the switch interfaces (31 to 34) for the chassis 1 trunks.

    interface Ethernet1/31

    description c1s1 f1-1

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 301 mode active

    interface Ethernet1/32

    description c1s1 f1-2

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 301 mode active

    interface Ethernet1/33

    description c1s2 f1-1

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 302 mode active

    interface Ethernet1/34

    description c1s2 f1-2

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 302 mode active

  6. Configure the switch interfaces (41 to 44) for the chassis 2 trunks.

    interface Ethernet1/41

    description c2s1 f1-1

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 3011 mode active

    interface Ethernet1/42

    description c2s1 f1-2

    switchport mode trunk

    switchport trunk native vlan 301

    switchport trunk allowed vlan 301

    channel-group 3011 mode active

    interface Ethernet1/43

    description c2s2 f1-1

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 3022 mode active

    interface Ethernet1/44

    description c2s2 f1-2

    switchport mode trunk

    switchport trunk native vlan 302

    switchport trunk allowed vlan 302

    channel-group 3022 mode active