Transitioning from a FortiLink split interface to a FortiLink MCLAG

You can use the FortiLink split interface to connect the FortiLink aggregate interface from one FortiGate unit to two FortiSwitch units. When the FortiLink split interface is enabled, only one link remains active.

In this topology, the FortiLink split interface connects a FortiLink aggregate interface from one FortiGate unit to two FortiSwitch units. The aggregate interface of the FortiGate unit for this configuration contains at least one physical port connected to each FortiSwitch unit.

NOTE:

• Make sure that the split interface is enabled.
• This procedure also applies to a FortiGate unit in HA mode.
• More links can be added between the FortiGate unit and FortiSwitch unit.
• On the global switch level, mclag-stp-aware must be enabled, and STP must be enabled on all ICL trunks. They are both enabled by default.
• Fortinet recommends using at least two links for ICL redundancy.

NOTE: If you are going to use IGMP snooping with an MCLAG topology:

• On the global switch level, mclag-igmpsnooping-aware must be enabled. It is enabled by default.
• The igmps-flood-traffic and igmps-flood-report settings must be disabled on the ISL and FortiLink trunks; but the igmps-flood-traffic and igmps-flood-report settings must be enabled on ICL trunks. These settings are enabled by default.
• IGMP proxy must be enabled.

The following procedure uses zero-touch provisioning to change the configuration of the FortiSwitch units without losing their management from the FortiGate unit. The MCLAG-ICL can also be enabled directly using console cables or management ports.

1. Using the FortiGate CLI, assign the LLDP profile “default-auto-mclag-icl” to the ports that should form the MCLAG ICL in FortiSwitch unit 1. For example:

   FGT_Switch_Controller # config switch-controller managed-switch

   FGT_Switch_Controller (managed-switch) # edit FS1E48T419000051

   FGT_Switch_Controller (FS1E48T419000051) # config ports

   FGT_Switch_Controller (ports) # edit port49

   FGT_Switch_Controller (port49) # set lldp-profile default-auto-mclag-icl

   FGT_Switch_Controller (port49) # end

   FGT_Switch_Controller (FS1E48T419000051) # end

2. Repeat step 1 for FortiSwitch unit 2. The port numbers can be different.
3. Disable the split interface in the FortiLink interface. For example:

   config system interface

   edit <aggregate_name>

   set fortilink-split-interface disable

   next

   end

4. From the FortiGate unit, enable the LACP active mode if not already set:

   config system interface

   edit <aggregate_name>

   set lacp-mode active

   next

   end

   NOTE: If you are using FortiOS 6.2 or earlier, use the set lacp-mode static command instead.

5. Check that the LAG is working correctly. For example:

   diagnose netlink aggregate name <aggregate_name>

If you disable the MCLAG ICL (with the set mclag-icl disable command), you need to enable the fortilink-split-interface.