Virtual Switch Extensions
The Virtual Switch concept was introduced in previous releases. It provides a container for physical ports to be loaned out to other VDOMs, which allows local management of the resource. In the original feature, only a minimum of switch capability was introduced, such as VLAN, allowed-vlan
, status, speed, poe-status
, and poe-reset
.
This extends some of the port capabilities including:
- poe-pre-standard-detection
- learning-limit
- qos-policy
- port-security-policy
- trunk ports (with some limitations)
Example
The following example shows how to export managed FortiSwitch ports to multi-tenant VDOMs. Some of the capabilities are available in previous releases of FortiOS, and the 6.2.0 release expands the functionality.
To export managed FortiSwitch ports to multi-tenant VDOMs:
- Configure switch VLAN interfaces, and assign them to the tenant VDOM:
In this example, the owner VDOM is root, and the tenant VDOM is vdom2.
(root) # config system interface
edit "tenant-vlan1"
set vdom "vdom2"
set device-identification enable
set fortiheart beat enable
set role lan
set snmp-index 34
set interface "aggr1"
set vlanid 101
next
end
- In the tenant VDOM, designate
default-virtual-switch-vlan
, which is used to set the native VLAN of ports leased from the owner VDOM:(vdom2) # config switch-controller global
set default-virtual-switch-vlan "tenant-vlan1"
end
- Owner vdom admin can export managed fsw ports to tenant vdom, as below
(root) # conf switch-controller managed-switch
(managed-switch) # edit S248EPTF1800XXXX
(S248EPTF1800XXXX) # conf ports
(ports) # edit port1
(port1) # set export-to ?
<string> string please input string value
root vdom
vdom1 vdom
vdom2 vdom
vdom3 vdom
(port1) # set export-to vdom2
(port1) # end
Alternatively, the admin of the owner VDOM can export managed FortiSwitch ports to shared virtual-switch pools for the tenant VDOM to pick, for example:
(root) # config switch-controller virtual-port-pool
edit "pool1"
next
end
(root) # conf switch-controller managed-switch
(managed-switch) # edit S248EPTF18001384
(S248EPTF18001384) # conf ports
(ports) # edit port8
(port8) # set export-to-pool pool1
(port8) # next
(ports) # edit port9
(port9) # set export-to-pool pool1
(port9) # end
- The admin of the tenant VDOM logs in, and configures the ports of the leased managed FortiSwitch, or the admin continues to lease/release ports from virtual switch pool.
Then in each tenant VDOM, the tenant admin can configure and leverage the FortiSwitch ports locally with limited range of operations based on the available CLI operations:
login: vdom2
Password: *****
Welcome !
$ show switch-controller managed-switch
config switch-controller managed-switch
edit "S248EPTF1800XXXX"
set type virtual
set owner-vdom "root"
config ports
edit "port1"
set poe-capable 1
set vlan "tenant-vlan1"
next
edit "port6"
set poe-capable 1
set vlan "tenant-vlan1"
next
$ conf switch-controller managed-switch
(managed-switch) $ edit S248EPTF1800XXXX
(S248EPTF1800XXXX) $ config ports
(ports) $ edit port1
(port1) $ set
port-owner Switch port name.
speed Switch port speed; default and available settings depend on hardware.
status Switch port admin status: up or down.
poe-status Enable/disable PoE status.
poe-pre-standard-detection Enable/disable PoE pre-standard detection. --> expanded to tenant VDOM in FortiOS 6.2
poe-capable PoE capable.
vlan Assign switch ports to a VLAN.
allowed-vlans Configure switch port tagged vlans
untagged-vlans Configure switch port untagged vlans
type Interface type: physical or trunk port.
qos-policy Switch controller QoS policy from available options. --> expanded to tenant VDOM in FortiOS 6.2
storm-control-policy Switch controller storm control policy from available options.
port-security-policy Switch controller authentication policy to apply to this managed switch from available options.--> expanded to tenant VDOM in FortiOS 6.2
learning-limit Limit the number of dynamic MAC addresses on this Port (1 - 128, 0 = no limit, default).--> expanded to tenant VDOM in FortiOS 6.2
(ports) # edit trunk1
(trunk) # set type trunk --> expanded to tenant VDOM in FortiOS 6.2
$ exe switch-controller virtual-port-pool request S248EPTF1800XXXX port8
$ exe switch-controller virtual-port-pool show