Fortinet Document Library

Version:

Version:

Version:

Version:


Table of Contents

Administration Guide

Download PDF
Copy Link

MCLAG

A link aggregation group (LAG) provides link-level redundancy. A multichassis LAG (MCLAG) provides node-level redundancy by grouping two FortiSwitch models together so that they appear as a single switch on the network. If either switch fails, the MCLAG continues to function without any interruption, increasing network resiliency and eliminating the delays associated with the Spanning Tree Protocol (STP).

This section covers the following topics:

Notes

  • When min_bundle or max_bundle is combined with MCLAG, the bundle limit properties are applied only to the local aggregate interface.
  • Fortinet recommends that both peer switches be of the same hardware model and same software version. Mismatched configurations might work but are unsupported.
  • There is a maximum of two FortiSwitch models per MCLAG.
  • The routing feature is not available within a MCLAG.
  • Starting in FortiSwitchOS 3.6.4, by default, the MCLAG can use the STP.
  • To use static MAC addresses within a MCLAG, you need to configure MAC addresses on both switches that form the LAG.
  • When you run an MCLAG, Fortinet recommends but does not require that peers use the same hardware and software versions. Some hosts might not be dual-home supported when MCLAG peers have different hardware; administrators need to size the layer-2 network to the MCLAG peer with the lowest capacity.
  • From the STP treeʼs point of view, the MCLAG switches should not present themselves differently as a single MCLAG dual-home virtual switch (accessed through an MCLAG trunk) and as a pair of STP running switches (accessed through asymmetric individual ports, typically in a ring topology). For example, the spanning tree with its root bridge outside of the MCLAG switches cannot connect to it through a dual-homed trunk on one side, while connecting to the MCLAG switches with asymmetric ports at the same time. Such configurations present a mixed view of the MCLAG switches to the STP instance and are not supported.

Example configuration

The following is an example CLI configurations for a MCLAG:

  1. Create a LAG by configuring the ports for each FortiSwitch unit:

     

    config switch trunk

    edit "MCLAG-ICL-trunk"

    set mclag-icl enable

    set members "port15" "port16"

    set mode lacp-active

    next

    end

     

  2. Set up the MCLAG:

     

    config switch trunk

    edit "first-mclag"

    set mclag enable

    set members "port2"

    next

    end

     

  3. If you do not want the MCLAG to use the STP:

     

    config switch global

    set mclag-stp-aware disabled

    end

Detecting a split-brain state

When the split-brain state occurs, one of switches in the MCLAG goes dormant. Any devices connected to the dormant switch will lose network connectivity. The switch that goes dormant is the switch with the lowest numerical MAC address between the two peers.

Starting in FortiSwitchOS 6.2.2, you can use the CLI to detect when an MCLAG is in a split-brain state when the MCLAG ICL trunk is down. When the LACP is up again, the MCLAG trunk is reestablished. You can use this command in both one-tier and two-tier MCLAG topologies.

By default, split-brain detection is disabled. To enable the detection of the split-brain state:

config switch global

set mclag-split-brain-detect enable

end

 

NOTE:

  • Enabling split-brain detection can cause some traffic loss while the LACP is renegotiated.
  • You can configure split-brain detection for multiple MCLAG pairs, but only one split-brain failure in a system is supported. You must fix the split-brain failure before proceeding.

Viewing the configured trunk

Using the GUI:

Go to Switch > Monitor > Trunks.

Using the CLI:

diagnose switch mclag icl

diagnose switch mclag list

Configuring an MCLAG with IGMP snooping

For IGMP snooping to work correctly in an MCLAG, you need to use the set mclag-igmpsnooping-aware enable command on all FortiSwitch units in the network topology and use the set igmp-snooping-flood-reports enable command on each MCLAG core FortiSwitch unit. For example:

config switch global

set mac-aging-interval 600

set mclag-igmpsnooping-aware enable

config port-security

set max-reauth-attempt 3

end

end

config switch interface

edit "D483Z15000094-0"

set native-vlan 4094

set allowed-vlans 1-4094

set dhcp-snooping trusted

set stp-state disabled

set edge-port disabled

set igmp-snooping-flood-reports enable

set snmp-index 58

next

end

MCLAG

A link aggregation group (LAG) provides link-level redundancy. A multichassis LAG (MCLAG) provides node-level redundancy by grouping two FortiSwitch models together so that they appear as a single switch on the network. If either switch fails, the MCLAG continues to function without any interruption, increasing network resiliency and eliminating the delays associated with the Spanning Tree Protocol (STP).

This section covers the following topics:

Notes

  • When min_bundle or max_bundle is combined with MCLAG, the bundle limit properties are applied only to the local aggregate interface.
  • Fortinet recommends that both peer switches be of the same hardware model and same software version. Mismatched configurations might work but are unsupported.
  • There is a maximum of two FortiSwitch models per MCLAG.
  • The routing feature is not available within a MCLAG.
  • Starting in FortiSwitchOS 3.6.4, by default, the MCLAG can use the STP.
  • To use static MAC addresses within a MCLAG, you need to configure MAC addresses on both switches that form the LAG.
  • When you run an MCLAG, Fortinet recommends but does not require that peers use the same hardware and software versions. Some hosts might not be dual-home supported when MCLAG peers have different hardware; administrators need to size the layer-2 network to the MCLAG peer with the lowest capacity.
  • From the STP treeʼs point of view, the MCLAG switches should not present themselves differently as a single MCLAG dual-home virtual switch (accessed through an MCLAG trunk) and as a pair of STP running switches (accessed through asymmetric individual ports, typically in a ring topology). For example, the spanning tree with its root bridge outside of the MCLAG switches cannot connect to it through a dual-homed trunk on one side, while connecting to the MCLAG switches with asymmetric ports at the same time. Such configurations present a mixed view of the MCLAG switches to the STP instance and are not supported.

Example configuration

The following is an example CLI configurations for a MCLAG:

  1. Create a LAG by configuring the ports for each FortiSwitch unit:

     

    config switch trunk

    edit "MCLAG-ICL-trunk"

    set mclag-icl enable

    set members "port15" "port16"

    set mode lacp-active

    next

    end

     

  2. Set up the MCLAG:

     

    config switch trunk

    edit "first-mclag"

    set mclag enable

    set members "port2"

    next

    end

     

  3. If you do not want the MCLAG to use the STP:

     

    config switch global

    set mclag-stp-aware disabled

    end

Detecting a split-brain state

When the split-brain state occurs, one of switches in the MCLAG goes dormant. Any devices connected to the dormant switch will lose network connectivity. The switch that goes dormant is the switch with the lowest numerical MAC address between the two peers.

Starting in FortiSwitchOS 6.2.2, you can use the CLI to detect when an MCLAG is in a split-brain state when the MCLAG ICL trunk is down. When the LACP is up again, the MCLAG trunk is reestablished. You can use this command in both one-tier and two-tier MCLAG topologies.

By default, split-brain detection is disabled. To enable the detection of the split-brain state:

config switch global

set mclag-split-brain-detect enable

end

 

NOTE:

  • Enabling split-brain detection can cause some traffic loss while the LACP is renegotiated.
  • You can configure split-brain detection for multiple MCLAG pairs, but only one split-brain failure in a system is supported. You must fix the split-brain failure before proceeding.

Viewing the configured trunk

Using the GUI:

Go to Switch > Monitor > Trunks.

Using the CLI:

diagnose switch mclag icl

diagnose switch mclag list

Configuring an MCLAG with IGMP snooping

For IGMP snooping to work correctly in an MCLAG, you need to use the set mclag-igmpsnooping-aware enable command on all FortiSwitch units in the network topology and use the set igmp-snooping-flood-reports enable command on each MCLAG core FortiSwitch unit. For example:

config switch global

set mac-aging-interval 600

set mclag-igmpsnooping-aware enable

config port-security

set max-reauth-attempt 3

end

end

config switch interface

edit "D483Z15000094-0"

set native-vlan 4094

set allowed-vlans 1-4094

set dhcp-snooping trusted

set stp-state disabled

set edge-port disabled

set igmp-snooping-flood-reports enable

set snmp-index 58

next

end