AP mode SLBC HA with LAGs third-party switch example
This example shows how to configure a single Cisco Nexus 3000 switch to provide redundant connections for LACP LAGs in an AP mode SLBC HA cluster.
The cluster includes two FortiGate-5000 chassis. Each chassis has two FortiController-5903Cs in slots 1 and 2 operating in AP FortiController mode and two FortiGate-5000 workers in slots 3 and 4. The primary FortiController-5903C in chassis 1 slot 1 is configured with two LACP groups. One LACP group contains the F1 and F2 interfaces, the other LACP group contains the F3 and F4 interfaces. These LACP groups are synchronized to the secondary FortiController-5903C in slot 2 and to the primary and secondary FortiController-5903Cs in chassis 2.
The Cisco Nexus 3000 switch requires two LACP groups for each FortiController, for a total of 8 LACP groups. To support redundancy, the LACP groups that connect the F1 and F2 interfaces of all the FortiControllers are on one VLAN (in the example, 301) and the LACP groups that include the F3 and F4 interfaces are on another VLAN (in the example, 302).
To set up the configuration:
-
Log in to the CLI of the primary FortiController (in chassis 1 slot 1) and enter the following command to create two trunks.
config switch fabric-channel trunk
edit "trunk01"
set mode lacp-active
set members f1-1 f1-2
next
edit "trunk02"
set mode lacp-active
set members f1-3 f1-4
end
The trunks are synchronized to all of the FortiControllers in the cluster.
-
Log into the CLI of the primary worker and enter the following command to add two FortiController trunk interfaces. These match the trunks added to the FortiControllers:
config system interface
edit "fctrl1/trunk01"
set vdom "root"
set ip 11.0.0.1 255.0.0.0
set type fctrl-trunk
set member fctrl1/f1 fctrl1/f2
next
edit "fctrl1/trunk02"
set vdom "root"
set ip 12.0.0.1 255.0.0.0
set type fctrl-trunk
set member fctrl1/f3 fctrl1/f4
end
The trunk interfaces are synchronized to all of the workers in the cluster.
-
Log into the Cisco nexus 3000 switch CLI.
-
Configure eight port channels, one for each FortiController LACP group:
interface port-channel301
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
interface port-channel302
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
interface port-channel3011
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
interface port-channel3022
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
interface port-channel401
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
interface port-channel402
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
interface port-channel4011
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
interface port-channel4022
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
-
Configure the switch interfaces (31 to 34) for the chassis 1 slot 1 trunks.
interface Ethernet1/31
description c1s1 f1
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
channel-group 301 mode active
interface Ethernet1/32
description c1s1 f2
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
channel-group 301 mode active
interface Ethernet1/33
description c1s1 f3
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
channel-group 302 mode active
interface Ethernet1/34
description c1s1 f4
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
channel-group 302 mode active
-
Configure the switch interfaces (41 to 44) for the chassis 1 slot 2 trunks.
interface Ethernet1/41
description c1s2 f1
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
channel-group 3011 mode active
interface Ethernet1/42
description c1s2 f2
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
channel-group 3011 mode active
interface Ethernet1/43
description c1s2 f3
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
channel-group 3022 mode active
interface Ethernet1/44
description c1s2 f4
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
channel-group 3022 mode active
-
Configure the switch interfaces (51 to 54) for the chassis 2 slot 1 trunks.
interface Ethernet1/51
description c2s1 f1
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
channel-group 401 mode active
channel-group 301 mode active
interface Ethernet1/52
description c2s1 f2
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
channel-group 401 mode active
interface Ethernet1/53
description c2s1 f3
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
channel-group 402 mode active
interface Ethernet1/54
description c2s2 f4
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
channel-group 402 mode active
-
Configure the switch interfaces (61 to 64) for the chassis 2 slot 2 trunks.
interface Ethernet1/61
description c2s2 f1
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
channel-group 4011 mode active
interface Ethernet1/62
description c2s2 f2
switchport mode trunk
switchport trunk native vlan 301
switchport trunk allowed vlan 301
channel-group 4011 mode active
interface Ethernet1/63
description c2s2 f3
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
channel-group 4022 mode active
interface Ethernet1/64
description c2s2 f4
switchport mode trunk
switchport trunk native vlan 302
switchport trunk allowed vlan 302
channel-group 4022 mode active