MCLAG
A link aggregation group (LAG) provides link-level redundancy. A multichassis LAG (MCLAG) provides node-level redundancy by grouping two FortiSwitch models together so that they appear as a single switch on the network. If either switch fails, the MCLAG continues to function without any interruption, increasing network resiliency and eliminating the delays associated with the Spanning Tree Protocol (STP).
This section covers the following topics:
- Notes
- Example configuration
- Detecting a split-brain state
- Viewing the configured trunk
- Configuring an MCLAG with IGMP snooping
Notes
For static routes in standalone, MCLAG, or layer-3 MCLAG network topologies, Fortinet recommends using a link monitor or BFD to detect whether the gateway is available. |
- When min_bundle or max_bundle is combined with MCLAG, the bundle limit properties are applied only to the local aggregate interface.
- Fortinet recommends that both peer switches be of the same hardware model and same software version. Mismatched configurations might work but are unsupported.
- There is a maximum of two FortiSwitch models per MCLAG.
- The routing feature is not available within a MCLAG.
- Starting in FortiSwitchOS 3.6.4, by default, the MCLAG can use the STP.
- To use static MAC addresses within a MCLAG, you need to configure MAC addresses on both switches that form the LAG.
- When you run an MCLAG, Fortinet recommends but does not require that peers use the same hardware and software versions. Some hosts might not be dual-home supported when MCLAG peers have different hardware; administrators need to size the layer-2 network to the MCLAG peer with the lowest capacity.
- From the STP treeʼs point of view, the MCLAG switches should not present themselves differently as a single MCLAG dual-home virtual switch (accessed through an MCLAG trunk) and as a pair of STP running switches (accessed through asymmetric individual ports, typically in a ring topology). For example, the spanning tree with its root bridge outside of the MCLAG switches cannot connect to it through a dual-homed trunk on one side, while connecting to the MCLAG switches with asymmetric ports at the same time. Such configurations present a mixed view of the MCLAG switches to the STP instance and are not supported.
Example configuration
The following is an example CLI configurations for a MCLAG:
- Create a LAG by configuring the ports for each FortiSwitch unit:
config switch trunk
edit "MCLAG-ICL-trunk"
set mclag-icl enable
set members "port15" "port16"
set mode lacp-active
next
end
- Set up the MCLAG:
config switch trunk
edit "first-mclag"
set mclag enable
set members "port2"
next
end
- If you do not want the MCLAG to use the STP:
config switch global
set mclag-stp-aware disabled
end
Detecting a split-brain state
When the split-brain state occurs, one of switches in the MCLAG goes dormant. Any devices connected to the dormant switch will lose network connectivity. The switch that goes dormant is the switch with the lowest numerical MAC address between the two peers.
Starting in FortiSwitchOS 6.2.2, you can use the CLI to detect when an MCLAG is in a split-brain state when the MCLAG ICL trunk is down. When the LACP is up again, the MCLAG trunk is reestablished. You can use this command in both one-tier and two-tier MCLAG topologies.
By default, split-brain detection is disabled. To enable the detection of the split-brain state:
config switch global
set mclag-split-brain-detect enable
end
NOTE:
- Enabling split-brain detection can cause some traffic loss while the LACP is renegotiated.
- You can configure split-brain detection for multiple MCLAG pairs, but only one split-brain failure in a system is supported. You must fix the split-brain failure before proceeding.
Viewing the configured trunk
Using the GUI:
Go to Switch > Monitor > Trunks.
Using the CLI:
diagnose switch mclag icl
diagnose switch mclag list
Configuring an MCLAG with IGMP snooping
For IGMP snooping to work correctly in an MCLAG, you need to use the set mclag-igmpsnooping-aware enable
command on all FortiSwitch units in the network topology and use the set igmp-snooping-flood-reports enable
command on each MCLAG core FortiSwitch unit. For example:
config switch global
set mac-aging-interval 600
set mclag-igmpsnooping-aware enable
config port-security
set max-reauth-attempt 3
end
end
config switch interface
edit "D483Z15000094-0"
set native-vlan 4094
set allowed-vlans 1-4094
set dhcp-snooping trusted
set stp-state disabled
set edge-port disabled
set igmp-snooping-flood-reports enable
set snmp-index 58
next
end