Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
MonkeyDiver
New Contributor

Managing Two 124E-FPOE from 60D in a stack downstream switches go offline

Hi,  I basically cratered my network authorizing 2 standalone 124E-FPOE switches to be managed inside a 60D fortigate.

 

the 60D is on 6.0.9 and the switches are on 6.4.1 

 

I enabled the DMZ port for switch management  and the fortigate sees the first switch fine, that switch has both INTERNAL connection from port 1 on the fortgate and it has the management port connected to port 24.   what dies is the entire connection to the second switch and thats done from a single fiber connection over port 25 on both switches.   I read that after 5.4.1 FortiOS that both management and data could flow over the same connection. And managing down stream switches in a stack was possible.   But this does not seem to be to intuitive.    what I noticed was the second I authorized both switches to be managed by the fortigate I lost direct connectivity to the switch management interface ( OK with this if I can actually control it from the fortigate) and it seems the fortigate created a VLAN called VSW.DMZ and all the ports on the switches seem to use that as the native VLAN

 

The state of the network is half up and half down.   Is there something I am missing?  I am unsure how authorizing a switch in the fortage shunts 100% of the traffic from a switch.   Thanks to all who can help. 

 

 

3 REPLIES 3
ede_pfau
SuperUser
SuperUser

In theory, this should work.

So far the good news. I stumbled upon a very similar situation in my lab and found out that by default "set access-vlan enable" was set. Didn't ring a bell with me but in practice this isolates the port from other ports on the same switch.

 

I disabled it and connectivity came back on.

 

I had to log in locally (console or IP) in order to open the ports.

 

Also, if I may mention this, quite daring to run v6.4.1 on the switches and v6.0 on the FGT. IMHO it's better they match, and that does NOT mean you should upgrade your FGT...


Ede

"Kernel panic: Aiee, killing interrupt handler!"
Ede"Kernel panic: Aiee, killing interrupt handler!"
MonkeyDiver

6.0.9 on the 60D is the highest I can take it.   There is no upgrade path beyond 6.0.9.

MonkeyDiver
New Contributor

I was able to sort it out today, it came down to the ports all defaulting the native VLAN to the one associated with the Management of the switches, Once I dialed the VLAN IDs into the right IDs the system lit back up.

 

Thank you for your help, but I can call this issue closed.

Labels
Top Kudoed Authors