AP mode single chassis SLBC with LAGs third-party switch example
This example shows how to configure a single Cisco Nexus 3000 switch to provide redundant connections for the LACP LAGs in an AP mode single-chassis SLBC configuration.
The FortiGate-5000 chassis has two FortiController-5903Cs in slots 1 and 2 operating in AP FortiController mode and two FortiGate-5000 workers in slots 3 and 4. The primary FortiController-5903C in slot 1 is configured with two LACP groups. One LACP group includes the F1 and F2 interfaces. The other LACP group includes the F3 and F4 interfaces. These LACP groups are synchronized to the secondary FortiController-5903C in slot 2.
The Cisco Nexus 3000 switch requires four LACP groups, two for the LAGs in the FortiController in slot 1 and two for the two redundant LAGs on the FortiController in slot 2. To support redundancy, the switch interfaces for the two F1/F2 LACP groups are assigned one VLAN (in the example, 301) and the switch interfaces for the two F3/F4 LACP groups are assigned another VLAN (in the example, 302).
To set up the configuration:
-
Log in to the CLI of the primary FortiController and enter the following command to create two trunks.
config switch fabric-channel trunk
edit "trunk01"
set mode lacp-active
set members f1-1 f1-2
next
edit "trunk02"
set mode lacp-active
set members f1-3 f1-4
end
The trunks are synchronized to the FortiController in slot 2.
-
Log into the CLI of the primary worker and enter the following command to add two FortiController trunk interfaces. These match the trunks added to the FortiControllers:
config system interface
edit "fctrl/trunk01"
set vdom "root"
set ip 11.0.0.1 255.0.0.0
set type fctrl-trunk
set member fctrl/f1 fctrl/f2
next
edit "fctrl/trunk02"
set vdom "root"
set ip 12.0.0.1 255.0.0.0
set type fctrl-trunk
set member fctrl/f3 fctrl/f4
end
-
Log into the Cisco nexus 3000 switch CLI.
-
Configure four port channels, one for each FortiController LAG:
interface port-channel301
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
interface port-channel302
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
interface port-channel3011
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
interface port-channel3022
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
-
Configure the switch interfaces (31 to 34) for the slot 1 trunks.
interface Ethernet1/31
description slot1 f1
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
channel-group 301 mode active
interface Ethernet1/32
description slot1 f2
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
channel-group 301 mode active
interface Ethernet1/33
description slot1 f3
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
channel-group 302 mode active
interface Ethernet1/34
description slot1 f4
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
channel-group 302 mode active
-
Configure the switch interfaces (41 to 44) for the slot 2 trunks.
interface Ethernet1/41
description slot2 f1
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
channel-group 3011 mode active
interface Ethernet1/42
description slot2 f2
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
channel-group 3011 mode active
interface Ethernet1/43
description slot2 f3
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
channel-group 3022 mode active
interface Ethernet1/44
description slot2 f4
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
channel-group 3022 mode active