Fortigate + HP ProCurve Load Balancing

fortinethp-procurvelacpload balancingnetworking

I have a FortiGate 100D + HP ProCurve 2824 linked together by 4x 1Gb links.

The ProCurve is configured to have ports 21-24 trunked together and load balance them.

The 4 cables from these ports are then fed into the 100D on ports 1-4 which are configured as a software switch (which should mean all 4 interfaces have the same IP address).

However when I connect the 4 links to the 100D the 100D itself becomes unaccessable but the network continues to function (the ProCurve must be using it's internal table to direct traffic) and there is no flood of packets as there would be in a network loop.

Has anyone ever run this kind of config on a FortiGate?

I'm convinced it's the FG end as the ProCurve is basically stock.

Cheers,
Myles

Best Answer

A trunk in HP terms is basically 802.23AD link aggregation, and you can optionally use that with LACP which can help verify that each link is capable of participating before actually sending data across it.

The Fortigate will need to support link aggregation and potentially LACP in order to communicate with the switch in this manner. Also, you can only use aggregation to the same switch, or switches combined with a stacking protocol or that support multi-chassis LAGs.

EDIT: Check the Fortigate admin guide page 166: http://docs.fortinet.com/fgt/handbook/50/fortigate-install-system-admin-50.pdf I see no mention of LACP support, be sure you do not turn that on at the switch, or it will kill the links.

config system interface
edit Aggregate
set type aggregate
set member port4 port5 port6
set vdom root
set ip 172.20.120.100/24
set allowaccess https ssh
end

Now, if I might steer you more effectively I see that IMIX throughput of a 100D is effectively 1Gbps so I don't really understand what you're trying to accomplish here. Do you have an upstream provider that is handing off a link larger than 1Gb?

Related Topic