Transitioning from a FortiLink split interface to a FortiLink MCLAG

You can use the FortiLink split interface to connect the FortiLink aggregate interface from one FortiGate unit to two FortiSwitch units. When the FortiLink split interface is enabled, only one link remains active.

In this topology, the FortiLink split interface connects a FortiLink aggregate interface from one FortiGate unit to two FortiSwitch units. The aggregate interface of the FortiGate unit for this configuration contains at least one physical port connected to each FortiSwitch unit.

NOTE:

• Make sure that the split interface is enabled.
• This procedure also applies to a FortiGate unit in HA mode.
• More links can be added between the FortiGate unit and FortiSwitch unit.
• On the global switch level, mclag-stp-aware must be enabled, and STP must be enabled on all ICL trunks. They are both enabled by default.
• Fortinet recommends using at least two links for ICL redundancy.

NOTE: If you are going to use IGMP snooping with an MCLAG topology:

• On the global switch level, mclag-igmpsnooping-aware must be enabled. It is enabled by default.
• The mcast-snooping-flood-traffic and igmp-snooping-flood-reports settings must be disabled on the ISL and FortiLink trunks; but the mcast-snooping-flood-traffic and igmp-snooping-flood-reports settings must be enabled on ICL trunks. These settings are enabled by default.
• IGMP proxy must be enabled.

Use the FortiGate CLI to change the FortiSwitch unitsʼ configuration without losing their management from the FortiGate unit. You do not need to change anything on the individual FortiSwitch units.

1. You can use the GUI (starting in FortiOS 7.2.4) or CLI to form the MCLAG between two switches.

   To use the FortiGate GUI:

   1. Go to Security Fabric > Security Rating. Look under Failed > Enable MC-LAG to find which pair of switches can form a tier-1 MCLAG.

      

   2. Go to WiFi & Switch Controller > Managed FortiSwitches. In the Topology view, hover over the inter-switch link between the pair of switches and then click Create MC-LAG pair in the dialog.

      

   To use the FortiGate CLI:

   1. Assign the LLDP profile “default-auto-mclag-icl” to the ports that should form the MCLAG ICL in FortiSwitch unit 1. For example:

      FGT_Switch_Controller # config switch-controller managed-switch

      FGT_Switch_Controller (managed-switch) # edit FS1E48T419000051

      FGT_Switch_Controller (FS1E48T419000051) # config ports

      FGT_Switch_Controller (ports) # edit port49

      FGT_Switch_Controller (port49) # set lldp-profile default-auto-mclag-icl

      FGT_Switch_Controller (port49) # end

      FGT_Switch_Controller (FS1E48T419000051) # end

   2. Assign the LLDP profile “default-auto-mclag-icl” to the ports that should form the MCLAG ICL in FortiSwitch unit 2. The port numbers can be different.

2. Disable the split interface in the FortiLink interface. For example:

   config system interface

   edit <aggregate_name>

   set fortilink-split-interface disable

   next

   end

3. From the FortiGate unit, enable the LACP active mode if not already set:

   config system interface

   edit <aggregate_name>

   set lacp-mode active

   next

   end

   NOTE: If you are using FortiOS 6.2 or earlier, use the set lacp-mode static command instead.

4. Check that the LAG is working correctly. For example:

   diagnose netlink aggregate name <aggregate_name>

If you disable the MCLAG ICL, you need to enable the fortilink-split-interface.