Hot!Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms

Author
Matthew
New Member
  • Total Posts : 9
  • Scores: 0
  • Reward points: 0
  • Status: offline
2021/02/08 07:27:10 (permalink)
0

Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms

Hello to all,
 
Iám  new to the Fortinet Products.
At the moment i concern onself with the Fortigate 100F Firewall.
 
Question:
 
It is possible to configure one LACP link (with to ports)  to a Switch, when i use multiple vDoms on the Fortigate 100F
and this Fortigate is also in a HA Cluster.
 
Because i read the below in the FortiOS 6.4.4 Adminstration Guide on Page 397:
 
Aggregation and redundancy

An interface is available to be an aggregate interface if:

It is in the same VDOM as the aggregated interface. Aggregate ports cannot span multiple VDOMs
 
https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/7d5dfa98-3a77-11eb-96b9-00505692583a/FortiOS-6.4.4-Administration_Guide.pdf
 
Does this mean i need a dedicated Interface pair per vDOM ?, or can i use Vlan´s on the 802.1q Trunk and then 
use one Vlan per vDom ?
 
Any recommendation / example configuration would be great.
 
Thank you.

 
 
 
#1

16 Replies Related Threads

    Toshi Esumi
    Expert Member
    • Total Posts : 2450
    • Scores: 237
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms 2021/02/08 10:53:34 (permalink)
    0
    In multi-vdom environment, you generally want to use VLANs on the trunked agg interface. Each VLAN subinterface can be bound to any vdom independently.
    #2
    Matthew
    New Member
    • Total Posts : 9
    • Scores: 0
    • Reward points: 0
    • Status: offline
    Re: Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms 2021/02/09 00:27:38 (permalink)
    0
    Thank you for the quick reply Toshi.
     
    If i get it right, you configure a LACP Interface with 2 physical Port´s on the Fortigate for each vDOM ?
    or for the root vDOM alone and then use Vlan´s in the other vDOMs and bound it to the LACP Interface on the root
    vDOM?
     
    Some configuration example may make it clear for me.
     
    Thank you.
     
    #3
    Toshi Esumi
    Expert Member
    • Total Posts : 2450
    • Scores: 237
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms 2021/02/09 08:21:51 (permalink)
    0
    By assuming the other end is terminated at a VLAN capable switch, regardless where/what vdom the physical agg interface is terminated at, we regularly don't assign any IP on it, or don't use non-tagged interface, but use only VLANs for all VDOM uses including root. Where on the other end it's switched with/without tags is up to the switch.
    #4
    Matthew
    New Member
    • Total Posts : 9
    • Scores: 0
    • Reward points: 0
    • Status: offline
    Re: Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms 2021/02/09 08:50:09 (permalink)
    0
    Thank you for the reply Toshi and interest.
     
    Still not 100% clear for me.
     
    Fortigate Interface 1 to  Switch(1) Interface 1 - LACP and 802.1q
    Fortigate Interface 2 to  Switch(2) Interface 1 - LACP and 802.1q
     
    Per VDOM : physical interface --> devided into subinterface for each VLAN -----> Fortigate tag the Vlan and send it across the link 
    is this correct ?
     
    How to achieve a LACP link with 802.1q trunking ?
     
    thank you 
    #5
    Toshi Esumi
    Expert Member
    • Total Posts : 2450
    • Scores: 237
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms 2021/02/09 09:45:11 (permalink)
    0
    Yes. Although each vdom doesn't care about physical interfaces.
    Below thread includes LACP config in the middle. All about mode, speed and algorithm config. I think it's automatically configured on any agg interface with active/slow/L3. We always use active-active to avoid any incompatibility issues.
    https://forum.fortinet.com/tm.aspx?m=174862
     
     
    #6
    Matthew
    New Member
    • Total Posts : 9
    • Scores: 0
    • Reward points: 0
    • Status: offline
    Re: Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms 2021/02/12 02:34:19 (permalink)
    0
    Thank you Toshi for the reply and interest.
     
    Iám still a liitle bit confused.
     
    Toplogy: Full mesh High Availability  Virtual Cluster with two FG.
     
    full mesh consist of 4 Switches ( switch pair stacked) and 2 FG with 3 VDOMS. No Inter-VDOM-routing necessary.
     
                            Server
                                |
                  Switch Stack (2 Switches)
                    agg. Trunk 802.1q
               FG 1 Primary-Hearbeat- FG 2 Secondary  ( VDOMS same one each FG)
                  agg.  Trunk 802.1q
                 Switch Stack (2 Switches)
                                |
                             Server
     
    Just to get it right now, each VDOM has normally 2 phy. Ports ingress and egress.
    I don´t want to use two dedicated phy. Ports for each VDOM.
    Is it instead possible to use a logical Interface in the shape of 802.1q trunk for each VDOM.
    So that at the end , i use  two phy. ports on each FG for the upper stacked switches agg. trunk and two phy. ports for the agg. trunk to bottom stacked switches ????
     
    regards
     
     
         
    #7
    Toshi Esumi
    Expert Member
    • Total Posts : 2450
    • Scores: 237
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms 2021/02/12 13:51:35 (permalink)
    0
    Yes, that's what I've been trying to explain. Each VDOM takes only a VLAN interface (physical interfaces and the agg interfaces need to be in one of them but doesn't matter which one).
    In case of "stacked two switches" and one leg goes to the first switch and another goes to the second, it's not generally called as "full-mesh" but practically accomplishes the same so we almost always use that topology for HA.
    #8
    Matthew
    New Member
    • Total Posts : 9
    • Scores: 0
    • Reward points: 0
    • Status: offline
    Re: Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms 2021/02/15 05:30:25 (permalink)
    0
    Hi Toshi,
    thank´s for your effort.
    This Solution ist not what iám looking for.
    I only want to use 4 phy. Interfaces per FG Firewall ( 2 leg for the upper 2 switch´s with agg. 802.1q Trunk
    and 2 legs to the bottom switch with agg. 802.1q Trunk.
    Then use logical Interface and bound it to the agg. Trunk Interface. 
    Not a additional phy. Interface per VDOM.
    Just 4 phy. Interfaces and 3 VDOMs per FG Firewall that´s it.
    thank you.
    #9
    Toshi Esumi
    Expert Member
    • Total Posts : 2450
    • Scores: 237
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms 2021/02/15 10:11:47 (permalink)
    0
    Isn't this what you want??

    Attached Image(s)

    #10
    Matthew
    New Member
    • Total Posts : 9
    • Scores: 0
    • Reward points: 0
    • Status: offline
    Re: Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms 2021/02/15 10:40:00 (permalink)
    0
    Hello Toshi,
     
    nice drawing.
     
    When the green dotted lines are NO phy. Interface and the Vlans to the bottom switch are the same for the upper
    switch. Mean Vlan 10,11 and 12 .
    Then the answer is yes. 
    Is it possible ?
     
     
    really thank you for the effort
     
     
    #11
    Toshi Esumi
    Expert Member
    • Total Posts : 2450
    • Scores: 237
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms 2021/02/15 19:20:43 (permalink)
    0
    If NAT mode, upper vlans and lower ones have to be different, otherwise the FGT can't route one side to the other. What do you expect the FGT to do if both sides (servers?) are on the same vlan? Then they would communicate each other without the FGT on Layer2.
    #12
    Matthew
    New Member
    • Total Posts : 9
    • Scores: 0
    • Reward points: 0
    • Status: offline
    Re: Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms 2021/02/18 00:17:03 (permalink)
    0
    Hello Tohshi,
    thank you that you mention that with the VLANs.
    I didn´t thought about this. 
    With inter-vlan routing i could use the same vlans on both sides, if i understand it right.
    Anyway is it possible with only 4 phy. Interfaces to achieve this solution in your drawing.
    Without one phy. Interface per VDOM for the sub-interface (VLAN) ?
    Maybe you have some example from your past work.
    Thank you so much for the effort.
     
    regards
     
     
     
     
    #13
    Toshi Esumi
    Expert Member
    • Total Posts : 2450
    • Scores: 237
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms 2021/02/18 11:26:26 (permalink)
    0
    I suggest opening a TT with TAC explaining exactly what you want to set up with your HA paired FGTs, which I still don't understand.
    #14
    sekar.karthi
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2021/02/11 23:47:18
    • Status: offline
    Re: Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms 2021/02/18 22:49:28 (permalink)
    0
    Here is a sample configuration... Keep in mind you cannot Aggregate (FW1-Port1 + FW2-Port1).
    What you can Aggregate is (FW1-Port1 + FW1-Port2 + ...)
    Your Aggregated Interfaces belongs to Root VDOM by default. You may create dot1q interfaces on top of that.
     
    config global
    config sys interface
        edit "AGG_L3SW"
            set vdom "root"
            set allowaccess ping
            set type aggregate
            set member "port5" "port6"
            set description "to L3SW"    
        next
        edit "VLAN100"
            set vdom "VDOM0"
            set ip 10.16.20.10/28
            set allowaccess ping        
            set interface "AGG_L3SW"
            set vlanid 100
        next
        edit "VLAN200"
            set vdom "VDOM1"
            set ip 172.16.20.10/29
            set allowaccess ping
            set interface "AGG_L3SW"
            set vlanid 200
        next
        edit "VLAN300"
            set vdom "VDOM1"
            set ip 172.16.30.10/29
            set allowaccess ping
            set interface "AGG_L3SW"
            set vlanid 300
        next
        edit "VLAN400"
            set vdom "VDOM2"
            set ip 172.16.40.10/29
            set allowaccess ping
            set interface "AGG_L3SW"
            set vlanid 400
        next
    end
    #15
    Matthew
    New Member
    • Total Posts : 9
    • Scores: 0
    • Reward points: 0
    • Status: offline
    Re: Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms 2021/02/19 01:30:51 (permalink)
    0
    Thank you Sekar.
     
     
    post edited by Matthew - 2021/02/19 01:37:31
    #16
    Matthew
    New Member
    • Total Posts : 9
    • Scores: 0
    • Reward points: 0
    • Status: offline
    Re: Fortigate 100F ( HA Cluster ) Link Aggregation for multiple vDoms 2021/02/19 03:18:41 (permalink)
    0
    Hello Toshi and Sekar,
    thanks for you effort.
    Toshi i attached a toplogy (not so nice like yours) to make it more detailed.
    Sorry for the headache :) 
    I want do use as less physical ports as possible on the FGT. Thats the main point.
    Use VLANS to separate the traffic for VDOM root and VDOM 1 -3.
    VDOM 1 -3 it is not necessary to communicate with each other.
    Traffic from Server to LAN should go only over  the primary path.
    Only use the backup path in case the FGT 1 crashes or a link goes down on the primary path.
     
    Any suggestion for this ?
     
    regards

    Attached Image(s)

    #17
    Jump to:
    © 2021 APG vNext Commercial Version 5.5