FortiSwitch Topologies and STP

0:07Hello and welcome. My name is Keith Barker. And in this set of videos, you and I are going to focus our attention on two basic things. Number one, the options we have regarding topologies in a layer 2 switching environment with FortiSwitch. And secondly, how do we-- if we have parallel paths, how do we prevent broadcast storms and loops from occurring? And that's with a feature called Spanning Tree. So in the next video, we'll take a big-picture look at some of those concepts. Then I'll walk you through step-by-step several of our options with both. So I'll see you, my friend, in the very next video.

0:00[MUSIC PLAYING] And welcome back. Using a FortiGate and its FortiLink interface to control one or more switches is a pretty amazing idea. And in this video, I'd like talk with you about some of our options regarding the connections and interconnections of switches and the FortiGate as well as a high-level overview regarding Spanning Tree Protocol. So let's start off with a single FortiGate and a single switch. And for that connection, we're going to use the FortiLink interface on the FortiGate. And then from the FortiSwitch, effectively, it's a trunk going up to the FortiGate.

0:33And trunks are going to use 802.1Q tagging. So if there's a frame for VLAN 10, it can be tagged on that trunk and sent up. And that way, the receiving device can know, oh, this is for VLAN 10, or oh, this is for VLAN 20. So I'd like you to remember that whenever we're talking about the FortiLink interface coming from the FortiGate and the FortiLink trunk coming up from the switch that it's supporting 802.1Q that's being used to tag and identify the individual frames as they go back and forth between those devices. So that's one option for a topology, one FortiGate and one FortiSwitch. And this link here could be a link aggregation group, or it could be a single interface.

1:05Either way is great. In fact, let me just assume we want some fault tolerance. And so I'll go ahead and put another one there and represent that as a link aggregation group right there. Now, another option we have is a FortiGate. So I'll draw that in. And instead of having one switch, we could have a stack of switches. Let me just go ahead and put three there. And once again, the connection between the FortiGate and the switch stack is going to be through FortiLink. And so if we're just going to one switch here, once again, that would be a link aggregation group. And then, we would have interconnections between these switches. And these connections between these switches are called ISLs, or Inter-Switch Links.

1:37Now, it's a little bit unfortunate, because that acronym also represents-- in the world of Cisco Systems, it represents their proprietary trunking protocol they came out with like 20 years ago, but they don't use it anymore. The industry is now using 802.1Q. So on this FortiLink connection from the FortiGate and the FortiLink trunk coming from the switch, it's also using 802.1Q for tagging. And these Inter-Switch Links are also using 802.1Q tagging. And once again, the acronym of ISL should not be confused with the Cisco old technology that was used for trunking previously.

2:10It's just the logical name for that connection between the switches that's supporting 802.1Q. So let's take a look at yet another option. We have another option, which would involve high availability, an HA pair. So here is FGT-- I'll put P for primary, and we'll have the FGTS for secondary. They've got their HA connection between them. And if they're connecting to one switch, we'll get a connection here and a connection here. And if we're running active standby, the firewall that's active would be actually interacting with the switch and support the FortiLink interface.

2:41And this same scenario could hold true if we had a switch stack right here as well. So FSW1, FSW2, FSW3. And still on the idea of HA, we have yet another option. So I'll put primary and secondary there for the firewalls. And let's put in some switches here, except I'll put these side by side. And of course, they've got their HA connection between them. And then, for the FortiLink interface, the primary would be connected to both stacks, and the secondary would be connected to both stacks, except the connection from the secondary wouldn't be used unless that secondary firewall went active.

3:12So on this HA pair here, I'll do the same treatment with the dotted line representing that's a backup. Also for fault tolerance, we could have ISLs here, Inter-Switch Links, also using 802.1Q for fault tolerance. Another option is deal with HA. I'll put it over here, do my two firewalls. And for the switch, we could have a two-tier hierarchy. So the FortiGates could go ahead and have their FortiLinks going down to this primary device, coming down here to this switch. And I'll label this FortiSwitch one. And then, below that, we could have additional FortiSwitches. Now, let's go ahead and put three and four there and then Inter-Switch Links between those.

3:45So this is referred to as a two-tier topology with this initial FortiSwitch one being the tier one and then the two below it being in tier two. And while I'm thinking of it, let me add another option over here with another FortiGate that's working with a stack of switches, so if they've got their ISL, their Inter-Switch Links. And what we could do with a FortiLink is we could have one of the members of the FortiLink go to the first switch and the second member of the FortiLink go to this third switch. Now, in this scenario, if we're not using multi-chassis link aggregation, which we'll talk about here in just a moment, on the FortiLink interface, we need to enable the split interface for FortiLink up at the FortiGate.

4:21So by enabling this split interface, the FortiGate is only going to have one of its two members here active at a time. So it might be the one going to FortiSwitch one, or maybe it'll be the one that's going to switch three. But it won't be both at the same time. So one, think of it like the primary path. And if that fails, it can then enable the secondary path, but it won't use it simultaneously. So in this corner right here, let me go ahead and label this as multi-chassis link aggregation. And this can be done with a single FortiGate or multiple FortiGates. So here at the top, we have our FortiGate. And then, here, we're going to have two switches that are acting as MC LAG peers.

4:53And then, between those two devices, we're going to have a connection, but it's not just an ISL. It's called an ICL, an Inter-Chassis Link, which is providing connectivity directly between FortiSwitch one and FortiSwitch two. So if we're going to use MC LAG, we have to have the FortiSwitches that support MC LAG. And for the FortiLink interfaces, we're going to go like this, from the FortiGate to FortiSwitch one and from the FortiGate to FortiSwitch two. And this is all one lag. And at this point, with multi-chassis link aggregation, we can disable the split interface for FortiLink.

5:27And that, we can leverage in this example, all four members of the FortiLink. So here, I'll jot down disable FortiLink split interface. And with multi-chassis link aggregation, we could do that also in combination with high availability as well. So with these options in mind, let's turn our attention to what happens if we have parallel paths between two or more switches? So let's imagine we have a switch here, and a switch here, and a switch here, and another one here. And we'll have a FortiGate with this FortiLink connected to one of those.

5:58Let's go ahead and do it right here with a link aggregation group. And then, for the ISLs, let's go ahead and do this, and this, and this. And let's imagine for this discussion we're just going to talk about one specific VLAN. So let's imagine we have a port here where the native VLAN in the world of FortiSwitch is VLAN one, and we have a device that's connected on this port. So there's our connection. And maybe this device is a PC or some other networking device. So logically, this PC that's connected to this port belongs to VLAN number one. So in the world of IP, there's a lot of broadcast that happen.

6:28For example, this client does an ARP request, address resolution protocol. It sends out a layer two broadcast that needs to be forwarded to all of the devices that are in VLAN one. In fact, let me change this scenario a little bit. Let's go ahead and make this VLAN 10 just for clarity. So now, this PC is in a port that has been assigned as VLAN 10. If this client does an ARP request, that broadcast needs to go to all of their ports associated with VLAN 10. So switch three is going to forward it over this trunk, the Inter-Switch Link, tagging it with VLAN 10 using 802.1Q tagging.

6:59Switch one is going to receive it, forward it to any other ports that it may have that are associated with VLAN 10 that are active and up. So that broadcast is going to go here, and here, and here, and here, assuming those ports are up. And switch three also has a trunk that goes down to switch four, another ISL. So the broadcast would be forwarded that way. And if there's any ports associated with VLAN 10 on FortiSwitch four, it'd be forwarded up those ports, again, if those ports are up and active. And FortiSwitch four has an ISL, which is using 802.1Q tagging. So it would forward it with the appropriate VLAN 10 tag over to FortiSwitch two, who would also forward it out any ports that are associated with VLAN 10.

7:33So no problem whatsoever so far. However, what if we did this? What if we added another ISL Inter-Switch Link right here, between FortiSwitch one and FortiSwitch two? Here's the problem. That ARP request, the broadcast that comes in, could go like this and just keep on going. That's because at layer two, there is no time to live feature, such as in an IP layer three packet. At layer two, there's no such time to live mechanism. So a frame could just be forwarded over, and over, and over again, and not just clockwise but also counterclockwise.

8:05And that causes all kinds of problems to show up in the network. Besides chewing up tons of bandwidth, the source Mac address is showing up on all these different ports, and the Mac tables are flapping. And it's a big problem. So the question may be, well, how do we solve that problem? And the answer is, we're going to solve that with a protocol called Spanning Tree Protocol, this guy right here. And there are several flavors of it. There is the original flavor, which has a standard number of 802.1D as in David. And then, there were some improvements on it, which is 802.1W for Rapid Spanning Tree and yet another one called 802.1S that was the original terminology for that flavor, which is referred to as multiple spanning tree.

8:43And here's the big picture overview regarding what Spanning Tree does. Spanning Tree has a method by using BPDUs, bridge protocol data units, to basically send out little messages and identify when there is a layer two loop or parallel paths in the network. And through a very logical process it follows, it's able to go ahead and prevent a loop. So if it sees this type of a loop, it can go ahead and tell one of these interfaces to stop forwarding. And that would prevent the loop from happening. So as far as which ports are going to forward and who's going to block based on the Spanning Tree, that's a discussion we're going to have in this set of videos in greater detail.

9:17But I wanted to point out in this overview that it's Spanning Tree Protocol that's doing the work behind the scenes to identify a parallel path at layer two and then proactively blocking on that path, so we don't have layer two loops. So now that we've taken a big picture look at some of our topology options with FortiSwitch and also a high-level concept of the Spanning Tree, let's continue this journey in the next video as we begin to walk through some of our topology options. So I'll see you in the next video in just a moment. Meanwhile, I hope this has been informative, and I'd like to thank you for viewing.

0:00[MUSIC PLAYING] And welcome back. Out of all the different typologies we talked about in the overview, our first option we looked at was one FortiGate. That can then go ahead and manage one FortiSwitch using the FortiLink interface, and that's the first one we're going to demo together. So let's map this out and then, oh, that's big. So let's map this out. I've got our firewall one, which will be our FortiGate, and we've got a switch, and we'll go ahead and use a 108E. So the FortiGate is a 60F, and the switch is a 108E and then for the FortiLink, let's use ports A and B, which are already part of the default FortiLink interface on this firewall.

0:40And let's plug that into port seven and eight, and in a previous set of videos, we already identified that port seven and eight already set up for FortiLink auto-discovery, so that shouldn't be a problem. But one other thing we also want to be aware of is compatibility regarding the FortiOS that's running on the firewall and the FortiSwitchOS, which is running on the FortiSwitch. So let's pause for a moment and take a peek at the compatibility matrix, and I just did a Google search for it. Let me make it a little bit bigger here. So we're getting FortiLink compatibility, it's got the FortiOS on the left, and across the top, it has the FortiSwitchOS flavors and versions.

1:15And the R is the recommended, so they're recommending that if you have FortiOS 7.0.5, that they're recommending you use FortiSwitchOS 7.0.3, and as new flavors and versions come out, they're going to update this matrix as well. But I also want to point out that if we go down here to the very tail end over here to the 3.6.11. So one of the questions that might come up is why in the world is there an R there, for recommended for 3.6.11, as well as 7.0.3 if we're using the FortiOS's 7.0.5?

1:45And the answer is we may have a switch [LAUGHING] that doesn't support version six or version seven, and that's why it's recommended. So oftentimes, companies will want to use the latest and greatest version that is supported on their hardware, as long as it's compatible. So what this is saying is that if we have an older switch with FortiSwitchOS 3.6.11 and we have FortiOS on the firewall with 7.0.5, that those are not only compatible but recommended. So if we're running an older version like 3.6.4 or something like that, we'd want to upgrade that for switch to 3.6.11 for compatibility and functional purposes.

2:19So here in my lab environment, the 108E that I'm using is running, I think 703 or maybe even 704, and the FortiOS on the firewall is running 705. So I think we're going to be super compatible there. So go ahead minimize that, bring back my graphic, and I think we're good to go. So before we actually bring up this FortiSwitch, I also want to take a peek at my FortiLink interface just to verify that physical interfaces A and B are both members. Also, because I'm going to the same switch, I don't have to enable the split interface. I can use both interfaces as a link aggregation group for effectively two gigabits of throughput between firewall one and the FortiSwitch.

2:54So let's go take a look at the firewall first. So here we go, so this is the firewall showing 7.0.5, that looks good. And right here, under the Security fabric, it doesn't show any FortiSwitch is connected. Also, here on firewall one, if we go down to Network and we click on Interfaces, this is just one way of looking at the FortiLink interface. We can double click on it right here, so this is showing us we have these two members, A and B, and automatically authorize devices is enabled from a previous set of videos. And FortiLink split interface is disabled, that means it won't just use one of those two member interfaces.

3:24It'll go and use both, because we're connecting to the same exact switch. So here's the IP address that we have on that logical interface here on the firewall, and here is the DHCP range that we're going to hand out from when FortiSwitches connect. All right, that looks good, and just to confirm, we don't have anybody here. Let's go down to Wi-Fi and Switch Controller, click on the link for Managed FortiSwitches right here, and sure enough, nobody's here. So I'm going to walk back to the rack and plug those cables in, and just for grins, I'm going to take another peek there. So port A on the firewall goes to port seven on the switch, and part B goes to port eight, fantastic.

3:57All right, those connections are made. I also took a little pen and hit the Mode button, and held it down for at least 10 seconds to reset the switch to factory defaults. So in just a few moments, they should power up and be auto-discovered by the FortiGate. So let's see if that's happening, we'll go ahead and go to Manage FortiSwitches. Sure enough, right there, it is coming online. We could also go to the CLI, and at the CLI on the FortiGate, we could do an execute switch-controller get-conn-status and then press Enter, and that will also show us. So currently, there it is, there's a switch ID, and any configuration it had in standalone mode is going to be wiped out.

4:33So currently, it says it's authorized, and that's because the FortiLink interface was set up for automatic authorization, but it's showing as down. There's no IP address assigned yet, so it's very likely in the process of rebooting right now. So we'll hit the up arrow key here, and looks like we need to get that a few moments. And while it's coming up, what we can do is we can right-click here, and just edit it, and we can give it a name. Let's call that guy Switch One, and we'll click on OK also, while we wait, we can just click on the FortiLink interface right here. You just verify that A and B are both green, and that's because we're not doing split interface, and we have both those connections going to the switch.

5:07And at this moment, this link on both of those ports, and that's why they're both showing green, so that's a good sign. If you go back to Manage switches again, ah, look, he's online. Good. Good. Good. So there's this name that we just gave it. There's the serial number, that's the model, there's our firmware version, fantastic. If we scroll to the right, there's the IP address that it was assigned via DHCP, via the FortiLink interface, and has been up for just a few minutes. All right, so if we click here on List and from the dropdown click on Topology, this should show us the topology. Look at that. Let me click on Refresh here.

5:38Nope. Nope. Nope. I know it's there because we saw the switch, so I'm going to go back to List. So it's here, if we go back to Topology it has not shown up. Sometimes this takes a few minutes to show up and update, so if you change your physical connections, your ISLs, and so forth, sometimes it does take a few minutes to show up. I do want to wait just for a moment or two just to make sure it shows up, and that'll give us an opportunity to verify the links involved between the firewall. Firewall one and the FortiSwitch, all right, one more refresh did it for us, fantastic. So if we hover on this link right here, it'll give us the details about all the ports involved.

6:10So port A, [LAUGHING] I'm laughing because it hasn't quite settled yet because it's showing interface A twice. It should be A and B going to port seven and eight because that's literally how it's connected. So I'm going to give this a few more moments to settle. So I'm going to do a refresh one more time, hover over that link again. So it's been a moment still showing port A twice. Now literally, it's port A and port B, so here on the firewall, if we hover here, it's showing the members as port A and port B, and as far as the physical connections involved, that should reflect A and B as well.

6:45All right, not a showstopper. So from here with this switch, if we wanted to go to the CLI on the switch, there are several ways of doing it. We could right-click on the switch and from the dropdown, say, I want to connect to the CLI, and that gives us a command-line interface over to that switch. So it's forcing me to change the password from nothing to something. So now here is the CLI for that switch. Go ahead and close that, and if you go back to our List View, there's a list of all our switches. At this moment, it's just one, and once again, we have options for Edit and Diagnostics and Tools, which we peeked out in a previous set of videos. But we'll click on it again here, so here's the details on that switch, including CPU and Memory Usage and Uptime.

7:20Here's the Faceplate with the ports that are currently up. There's details on the ports down here we can scroll through. There's the Cable Test option, a section for logs, and CLI access again, right here. And if we want to see logging information from the switch, if we go down to Log and Report and we click on Events, there's a section right here for FortiSwitch Events. So if we click here on FortiSwitch Events, currently is pulling from FortiGate Cloud, but we could also look at Memory, and here's the work that we did over the last 10 minutes. Everything before that was me playing around and verifying. So the switch was Discovered, it was automatically Authorized based on the FortiLink interface, it built a CAPWAP Tunnel.

7:55So when we do logging from these switches over to the FortiGate, it's logically done over the CAPWAP tunnel. And if we want to take a look at the details for this, we can click on the Details button to get more details on what that event was all about. All right, so going back to Wi-Fi and Switch Controller and our managed for FortiSwitches, and once again, we'll go back to our Topology view. So this is an example of one FortiGate with its FortiLink interface and aggregate interface connecting to a single switch, which in our case is switch one. And in the next video, we're going to build our switching environment by creating a switching stack by attaching a second switch behind switch number one.

8:29So that's what we get to do in the next video. I'll see you there in just a moment. Meanwhile, I hope this has been informative, and I'd like to thank you for viewing.

0:00[MUSIC PLAYING] And welcome back. In the previous video, we had a single FortiGate with its FortiLink interface managing now one FortiSwitch. In this video, we're going to add on to that by creating a stack of switches by adding at least one, maybe two additional switches to our existing environment. So here's what I propose we do, let's go ahead in creating our stack. We already have our FortiGate, we already have our initial switch with the FortiLink connection and the FortiLink trunk between the firewall and that switch.

0:31Let's go ahead and add a couple of additional switches side by side. We'll make a second tier. So let's create switch 3 and switch 4. And all we need to do on these switches is make sure that the porch we're using on these switches are enabled for auto discovery. If they are, they'll be automatically discovered by the firewall. So on this switch, which is a 180e, it has two SFP ports, small form pluggable formats. And I have a couple of adapters that are plugged in there. I bought a bag of them about, I don't know, a year or two ago, just miscellaneous ones.

1:02And so assuming they work, if we want to use those, those are ports 9 and 10, and what I propose we do is let's take port 9 with some fiber optic cable and go from the SFP in port number 9 over to the SFP on switch 3 also in port number 9. And let's take the SFP in port number 10 and use some fiber optic cable to go ahead and connect over here to the SFP on switch 4 on its port number 10. They don't use the same numbers. But I want to do that just so I know which switch is connected to which port. Now, these two switches here, they are 108D power over Ethernet, 108D.

1:38And I bought these used. So this one right here is fairly current running what was the 703 or 704 of the software. And these two, I think they're running 3.6.11. So based on the matrix that we looked at, the compatibility matrix, they should still work because they're running that version of software, which the matrix said was compatible with the 40 OS, which was 7.05. So there's a few variables here but we'll check it out together. So also here on switch 1, I'm going to go ahead and click on it, and click here on diagnostics and tools.

2:09And so here on the faceplate shows ports 9 and 10 are the SFPs and look at that. I'm just hovering on the faceplate over port 9. It says this transceiver is not certified by Fortinet and it's a Cisco agilent. And what do I have in port 10? A Cisco-- wow, I've got two different SFPs and they're both not supported by Fortinet. But in my testing, they worked. So I'm going to go ahead and use them. So based on our plan, we'll have port 9 on this initial switch go to switch 2 and port 10 go to switch number 3.

2:40I'll go make those physical connections right now. And I thought, let me just show you the cables real quick before I plug them in. And so the SFPs have the LC connector for the fiber and that's what these are here. So I'm going to use this one between switch 1 and switch 2, and this one between switch 1 and switch 3. All right, so those are plugged in. And I also took the liberty of resetting switch 2 and switch 3 to their factory defaults. I did that by just pushing a pan on the mode button for at least 10 seconds, and that resets them to their default and reboots them. So let's go ahead and close this.

3:11And OK, good, good, we're having some indicators here on the topology view. So with managed FortiSwitches is selected, let's go back to our list. So currently, I don't see additional switches. But if we go to the CLI, that's probably a faster way to see the activity. So we'll do an execute, switch controller, get connection status, and enter. Oh, there we go, yes, the other ones coming up. So there's the 108D, one of them. And in just a few minutes, we should see the second one as well. So I'm going to give that about 4 or 5 minutes to settle, and then, we'll come back and take a look at the results.

3:42All right, so it's been about a minute, still in the process of onboarding. So let's go back to our list here and go to the topology view. So in a few moments, this topology view is going to show us the connection. So whoever is connected to port 9, that's switch 2 and whoever is connected to port 10, that's switch 3. So I'm going to wait just a moment before I try to rename these, so I can put the right name on the right switch. All right, so it's been a moment and it just refreshed. And this is port number 9, so that is switch number 2. So I'm going to rename that by right clicking. Click on edit and we'll call that switch 2. Fantastic, and click on OK.

4:15And then, this must be switch 3. It'll show up here in a moment being connected to port 10. So we'll edit and we'll call this guy switch 3. So it looks like switch 3 is up. So if we want to go to the CLI on that switch for any reason, we could right click on it. And then, from the dropdown, click on right here, connect to CLI, command line interface. All right, we are connected. So do a get system status on that device. It's a FortiSwitch 108D version 3.6.11. There's the serial number, the BIOS version, the burned in Layer 2 address, the Mac address, the host name we gave it, fantastic.

4:46And let's do a config switch trunk. Let's do a quick show command. So this is showing us that this port, which is port number 10, is a trunk as due to auto ISL, the interswitch link between switch 1 and switch 3. And it's using link access control protocol to negotiate that trunk. So when we have two devices like these two switches here, switch 1 and switch 3, and they've got their ISL connection between them, which is the labeling for the trunk that set up between them, and that trunk is using 802.1Q.

5:16And negotiating and setting up that trunk, they used link aggregation control protocol, which is an open standard. And the option is for link aggregation control Protocol are active or passive. And so if this site is active and this site is active, that means they will both initiate a conversation with the other side to negotiate a trunk. If one site is active and the other site is passive, the active site will start the conversation and they'll set up a trunk. So active-active works on either side, active-passive works. However, what doesn't work is passive on one side and passive on the other side.

5:47It's like two people just waiting for the other one to make a move and nobody starts the conversation. Now, the cool thing about this is that with auto ISL, we had to do nothing about that, it just automatically did it by itself as part of FortiSwitch. Also, behind the scenes, you're using LLDP, link layer discovery protocol to identify who the peer is and the details of that peer who's connected over that link. And we don't have to go to the CLI on the actual switches to see most of this information. We also have commands at the FortiGate, who's managing all these switches, where we can also see this information.

6:21So we clean that up a little bit. And let's go ahead and exit out of that. And let's refresh this page. All right, good, good, good. So if we hover over these links, it's going to show us the details about the ports involved. So on switch 1 is using port 9, on switch 2 is using port 9. It's showing us this speed. And we have slightly different information that's available here regarding spanning Tree Protocol, and we'll talk about that difference here in a subsequent video coming up. So this is an example of one FortiGate managing a stack of FortiSwitches. Now, in our next video, what I'd like to do is kick it up a notch and let's do HA with two firewalls acting as an HA pair that are working with a stack of switches.

6:57And we can leverage this existing stack as we currently have for that process. So I'll see you in the next video for HA. Until then, I hope this has been informative, and I'd like to thank you for viewing.

0:06And welcome back as we up the ante in each of these videos. In this video, we're going to take a look at using HA-- High Availability-- with two FortiGates, managing and working with a FortiSwitch stack. So currently, we have ports a and b that are going to port 7 and 8. And here's what I propose we do. Let's take another firewall, and we'll make it an HA pair with firewall 1. And instead of using a and b going to switch 1, let's use this port a, going to the switch to port 7. Then we'll have port a down here going to the switch over on port 8.

0:36So before we're done, we'll make sure we have those connections in place physically. And as far as this failover device, this HA device, I'm not sure it's state. So let's go ahead and connect to it with a console cable. Let's wipe it out. And let's add this to firewall 1 to make the HA pair. So to make this work, we need to make sure on both firewalls we have the same connections. So we're going to have port a go down to switch 1, to port 7. And port a over here go down to port 8 on switch 1. Then for all my other connections, I have port 1 that's connecting to my home office network.

1:08So I'll make sure those two connections are in place on this second firewall after we wipe it down. So let's make a road trip over to this firewall and get it set up for HA. So this is my remote desktop session over to the computer behind me by the rack. And I'm just going to open up a terminal emulator and connect over. And let me just check my settings real quick. Actually, let's see if it works. That is not flying. Let's see what my speed is. Go ahead and do an edit. Currently, it's at 115,000 bits per second. Let's try at 9600 for the firewall. I think the switches take 115, and that's why I had it set there.

1:40Let's go to 9600, click on OK, press Enter, and nothing. Let me make sure the firewall is on. Yep, the firewall is on. It's not-- let's go ahead and just start from scratch here. I'll say, do I want to delete this? Yes. And then we right click that and delete that. Click on Yes. And let's start a new session. And we'll select serial 9600. That looks good to me. Click OK. OK, COM3. That's my USB port. All right, that looks good. So we'll go ahead and log on. And let's do an execute factoryreset. Question mark. Yep, that's it. And yes, and it is off to the races.

2:12So it's going to come back with an IP address of dot 99, because that's the default. And then we'll walk through the quick steps to set it up as an HA pair over with firewall 1. All right, so that bad boy is reset. And if you just log in real quick and change the password. All right. Let's do a get system interface. So it's just to confirm, 192.168.1.99 is where it's reachable at, at the moment. Sure enough, right there. And then we also do an execute ping, see if we can reach my default gateway here in my home office. Oh yeah, that looks good. That means I can reach that IP address from this computer.

2:44So let me go ahead and minimize that. And back at firewall 1, let's go ahead and set up for HA. And I'm also going to use my dmz interface for that purpose. So if we go to Interfaces on my firewall, I literally have an interface called dmz. So on firewall 1, we'll go to System and click on HA. And we want to say we want to be in Active-Passive. And for the device priority, the default is 128. The bigger the better. Let's go to 200. And for the group name, let's call this Cluster1. And regarding the heartbeat interface, let's go ahead and use the dmz interface. So that interface is connected with a crossover cable between firewall 1 and the second firewall that we just wiped out a moment ago.

3:20So with that selected, we'll go ahead and close and click on OK. All right, it's synchronized with itself. Woo-hoo. So let's open up a tab over to the other firewall at dot 99 and have him join the party. So we'll open up a new tab. All right, it's using a self-signed certificate. So we'll go ahead and continue. We'll log in. And we'll go ahead and do this right now. I'll call this firewall 2 and optimal dashboard. So here on firewall 2, once again, we'll go to a system. Under system, we'll click on HA, and we'll say, please join the party Active-Passive with a lower priority than the other one.

3:54And the group name is Cluster1. And the heartbeat interface is going to be our dmz interface. And we'll click on OK. All right, so I'm going to go ahead and close that. And let's go back to firewall 1, and we'll bring that full screen. All right, so here at firewall 1, it says we're not yet synchronized. So if we hover over this, it's going to show us that we have a few things that are not yet synchronized. But I think they're all coming. We'll give it a few minutes to complete. All right, it's been a moment or two. Let's go ahead and see if we're getting any closer. Oh, you know what, we had five tables out of sync. Now we have one. So I think it is almost done.

4:24Looks like it's synchronizing the managed switch information. Fantastic. All right, it says it is synchronized between firewall 1 and firewall 2. Fantastic. And if you go to the dashboard, let's go ahead and add a widget for HA. So we'll click on Add Widget. So we'll add one for HA. Add it. All right, so let's go take a look at our FortiSwitch. So now with HA, if we go back down to our Wi-Fi and switch controller, and then down further to Managed Switches, this is now representing our HA pair, managing this switch stack with switch 1, and then going on to tier 2 with switch number 2 and switch number 3.

4:56And one of the key ideas regarding fault tolerance and high availability is that we had to test it before we need it, just to make sure it's going to do what we think it's going to do. So what I'm going to do right now is I'm going to walk back the rack and I'm going to physically pull the power from firewall 1, which should cause the secondary firewall to become active. And if everything works well, it should be fairly transparent to everybody involved, including the management of our switched environment. So I just physically pulled the power from firewall 1. And so as a result, firewall 2 should be now going active and supporting the network.

5:27So let me go ahead and do an F5 to reconnect. And sure enough, I'm getting a response. Click on Advanced, Proceed. And now we are logging into the secondary unit, who's now active. But from the perspective of the network and everything else, it's all good to go. So here we are at firewall 2, which is the active firewall. It's acting as the primary device. And you'll notice here in our switch management, it's showing that port 7 is down. And that's where our firewall 1 had been connected previously. So now its firewall 2 as part of the HA pair, which is physically connected to port number 8.

5:57So if we go down to HA again under System and HA, all we have now is firewall 2, who's performing the management of these switches. And not just the management, but any security policies and traffic flows that we're controlling through this firewall are now being handled by firewall 2. So right after this video is done, I'm going to go back to the rack, I'm going to power back on firewall 1, and have it become the primary again as part of the HA pair. And in the next video, I'd like to discuss with you the concept of STP and its various flavors, and how important it is in a switched environment. So we'll do that in the next video, and I'll see you there in just a moment.

6:29Meanwhile, I hope this has been informative, and I'd like to thank you for viewing.

0:07And welcome back. In this video, you and I get to chat about the reason for, and some flavors of, Spanning Tree Protocol. So let's begin with some switches. And let's go ahead and put three of them here, and two of them here. And we'll call these FSW1, 2, 3, 4, and 5. And let's imagine that these switches have trunks, and they're referred to in the world of FortiSwitch as ISLs, Inter-Switch Links, supporting 802.1 Q. Let's go ahead and do this and this.

0:41Now, the problem with this type of layer 2 topology is that there's no fault tolerance. If FortiSwitch 2 fails, that means everyone over here on this portion of the network won't have access to this portion of the network. So oftentimes, we're going to have some fault tolerance by having multiple connections, including a connection, maybe, like that, and maybe one there. So multiple paths is great for fault tolerance, but in layer 2, there's no time to live mechanism inside of a layer 2 header. So we have the opportunity for one broadcast to be forwarded over and over and over throughout the network millions of times. So we need some way of stopping that from happening.

1:13And one of those ways is Spanning Tree Protocol. And there's three major flavors of Spanning Tree. The first was 802.1D. And then there's 802.1W, which is called Rapid Spanning Tree. And then one that's called 802.1s, which later was incorporated into a different standard, but they all do basically the same thing. The purpose is to identify parallel paths and then to block on one or more of those links so there is not a parallel path, and we don't have loops in the network. So let me give you the big picture regarding how Spanning Tree operates.

1:44The first rule of the road regarding Spanning Tree is to elect a root bridge. And think of the word "root," think of the root of a tree. So here is the trunk, or the root of the tree right here. And then as the tree goes out, we have branches and-- it's a pretty sad tree-- but you notice the branches. They don't grow back in on each other. They only go one way. And as a result, the tree has no loops in its branches. They all go out, but they don't grow back into themselves at some other weird point. And that's what the goal of Spanning Tree is as well, to make sure we have paths to the network, but not having any loops.

2:18And the word "bridge" is a throwback to when this protocol was created, when we had bridges that performed, effectively, a layer 2 switching function, except they weren't very fast and there weren't a lot of ports. So the root bridge, think of it like the root of the tree. So let's imagine all these switches are supporting Spanning Tree. And what they're going to do is they're going to set out little BPDUs. A BPDU is a Bridge Protocol Data Unit. Think of it like the language of love that these switches are going to use and send back and forth to communicate with each other. And through the process of exchanging bridge protocol data units, they're going to find out which of these five switches has the lowest bridge ID.

2:53And the bridge ID is made up of a combination of a priority number, followed by a base MAC address. So if we wanted to artificially make one of these lower, all we'd have to do is lower the priority number, and effectively, that would lower the bridge ID, also known as a BID. And that would make it win the root bridge election. It would be the root bridge for Spanning Tree. However, if we just left the priority alone on all of these and it wasn't modified, then it boils down to which of these switches has the lowest base MAC address that's been assigned to it. So in our Spanning Tree, we're going to have one, and only one, root bridge.

3:24And so for this diagram, let's go ahead and choose switch 2 as the root bridge. Let's say it won because it has the lowest bridge ID. Congratulations, switch number 2. You are the root bridge for Spanning Tree. Next, let's talk about the losers. And you might say, Keith, what do you mean, losers? Well, if there's only one root bridge, all the other switches are losers. And that's a good way to think about it, because on each of the losers, they need to identify which one of their ports is the best one to use to forward traffic in the direction of their root bridge.

3:54And so all the losers are going to choose one root port. So I'm going to label these ports. I'm going to call this port 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, and 13. And the reason we're going to use unique numbers on all these ports is just so that when we're talking about them together, we'll be very clear on exactly which port we're talking about, because no two ports in this topology have the exact same number. And I missed a port here, so we'll give this guy port number 13.

4:25So switch 2, as the root, is advertising the cost to get to itself. And no matter where you go, there you are. So the cost for switch 2 to get to itself is zero. So it's advertising 0 in BPD as going here and here and here and here. And then these other switches have a local cost associated with their interface, for example, maybe a cost of 4 here, and a cost of 4 here. And let's just say all the interfaces have a local cost of 4. So in these loser switches, the ones who are not the root, are deciding which port they should use as a root port that should be forwarding towards the root, they are going to do it based on the lowest cost.

5:00So as an exercise, let's do the math here for switch number 1. It's receiving a cost of 0 here from the root switch. And its local cost is 4. So a forwarding this direction has a cost of 4. And if we look over at switch number 3, it has a cost of 4 to get to the root. So it would be advertising the cost of 4, and so it would be a cost of 8 going here. And same thing here. Switch 4 is going to have a cost of 4. He's advertising the cost, plus the local cost. That'd be 8. So when switch 1 is making its decision about which interface should be the root port and has the lowest cost forward towards the root, it's going to choose port number 2.

5:32And that's going to be the root port. I'll put RP there. And every switch that's not the root itself is going to have one root port, which is forwarding towards the root. So we'll say RP is forwarding towards root. And based on the same logic, switch 3 is going to have this as a root port. That's going to be the cheapest cost. Switch 5 is going to have this port as the root port. And switch 4 is going to have this port as the root port. So all the other switches-- 1, 3, 5, and 4-- have identified their root port based on the lowest cost to get to the root. Now there's another concept, also, as far as port roles, and that's called a designated port.

6:06And a designated port is forwarding frames at layer 2 and forwarding away from the root. And each network segment between two switches has to have at least one designated port. So the root bridge, because it's the root, all of its ports are going to be designated. They're all forwarding away from itself. So this is going to be a designated port. That's a designated port. That's the designated port. That's a designated port. And again, for each segment of the network there needs to be one designated port that's forwarding traffic away from the root. So these four links that switch 2 is directly connected to all have designated ports.

6:38So I'll put one per segment here. Now, where it gets a little bit tricky with designated ports is between switch 4 and switch 5. And let me add the Ws there. I'm not sure why I forgot those earlier. So one of these two switches needs to be the designated switch for this segment right here. And so as far as who gets to be the designated port for that segment, it's going to be which switch has the lowest cost, so lowest cost to get to the root. So currently switch 4 has a cost of 4 to get to the root. And switch 5 has the cost of 4 to get to the root. So that's a tie. And if that's a tie, which it is in this topology, the next thing they would use is which of these two switches, switch 4 or switch five, has the lowest bridge ID, because those are going to be unique.

7:17So let's manage that switch 5 wins that because it has the lowest bridge ID. It would then be the designated port for that segment. And so each segment is going to have one and only one designated port. So then we have that same problem here between switch 3 and switch 5. Which of these two devices has the lowest cost? If they both have a cost of 4 to get to the root, then it's going to be based on lowest bridge ID. And let's imagine that switch 5 also wins that. So that's going to be a designated port. And then we have the same scenario here between switch 4 and switch 1. So let's match that switch 1 has the lower bridge ID, so it becomes the designated port.

7:48And then we have one more that we haven't identified and that's between switch 1 and switch 3. And they both have a cost to 4 to get to the root. So let's imagine that switch 1 has a lower bridge ID, the tie breaker, between switch 1 and switch 3. And as a result, it becomes the designated port. So just as a quick check, the root bridge, all of its ports are designated. They're all forwarding away from itself. So that takes care of this segment, this segment, this segment, and this segment. We identified the winner for this segment, which is switch 5, the winner for this segment, which is switch 1, and the winner for this segment, which is switch 1, also.

8:19And Then the final step is to take any of these connections between switches, which aren't designated ports or not root ports, and those will end up being blocked. So this port 5 on switch 3 would end up as being blocked. And this port here would be blocked. And this port here, port 9, would be blocked. And that addresses the entire topology. So effectively, we have a tree as a result of Spanning Tree. So this is the original flavor of Spanning Tree. This is referred to as Rapid Spanning Tree. And Rapid Spanning tree has some improvements regarding conversions.

8:50If there's a change it handles it better, it converges faster. And some of the terms are different between STP and rapid STP. For example, with STP they had a concept called blocking, which is what's happening right here. It's blocking on that port from a Spanning Tree perspective. So we don't have a loop. However, in Rapid Spanning Tree, that's referred to as discarding. However, at the end of the day, it's the same function. We're not forwarding frames out this port because it's in a blocking, or with Rapid Spanning Tree, a discarding state. Now, at Cisco Systems, they implement something called Per-VLAN Spanning Tree. And with Per-VLAN Spanning Tree, if you have 20 different VLANs, you have 20 different instances of Spanning Tree.

9:27Now, there's another standard called Multiple Spanning Tree, which is often written as MST, which was the original standard of 802.1s. And what it does, it creates Spanning Tree instances. So it has a Spanning Tree instance of zero, and by default all the VLANs mapped to that same instance. So instead of having, for example, 20 VLANs and 20 separate instances of Spanning Tree, you can have, for example, instance one and instance two. You can say, I want VLANs 2 through 19 to map to that instance. And VLANs 20 through 29 to map to that instance.

10:00And then you have a lot less overhead using multiple Spanning Tree. Think about multiple VLANs mapping to the same Spanning Tree. And here's the takeaway with FortiSwitch. By default, in the background, they are running MST, which has all the bells and whistles and benefits of Rapid Spanning Tree, plus the benefit of using less instances compared to Per-VLAN Spanning Tree. And the whole discussion regarding the details of 802.1s would take an entire another course. And what I want you to take away from this discussion is the idea that Spanning Tree has the purpose of identifying parallel paths in a layer 2 network and then implementing blocking on one or more ports to prevent a layer 2 loop.

10:41And that's true with or 802.1D, 802.1w, as well as Multiple Spanning Tree. And to help reinforce that, I brought back Firewall 1 as my primary firewall in the HA pair here in the topology view regarding managed FortiSwitches. If we hover over an interface here, you notice in the output under STP status, it says forwarding, and the same thing here for port 10 is forwarding from an STP status perspective. And we have a link between here and here, between switch 2 and switch 3, that would be a layer 2 loop. And Spanning Tree would identify that, and as a result, one of these ports would be designated and forwarding, and the other would be blocked.

11:17Or with Rapid Spanning Tree and MST, it'd be referred to as discarding. And what I discovered is that on this switch right here, which is a 108E with current firmware, it reports that forwarding state accurately. And on my older switches here that I purchased used-- I think they're running like 3.6.11-- the output here in the topology view doesn't always accurately reflect what the actual Spanning Tree state is. But what we can do is we can go to the CLI on the FortiGate, and we can get that Spanning Tree information from those switches. So here on the FortiGate, let's go to the CLI on the FortiGate.

11:49And let's get our list of switches with an execute switch controller, get-conn-status and press Enter. So there's our three switches. And let's take a peek at Spanning Tree for switch number 1, which is the root of our Spanning Tree. So all of its ports should be designated and forwarding. So to see that here at the FortiGate interface, we'll do a diagnose switch controller, switch info STP, then we'll go and copy and paste that switch ID in. So that's switch number 1. We'll press Enter. And so here is MST instance 0. There's also instance 15, which it created to support VLAN 4094, which is the VLAN being used for the management of the switch stack.

12:26And in both cases, it's showing that this bridge is the root, this is switch 1, and all of the ports that are enabled are designated, and they're also forwarding. So if we did that same command-- let's go ahead and hit the up arrow key a couple of times. And let's do it for this switch right here. I'll go ahead and copy that ID, and then hit the up arrow key a couple of times. And we'll look at this for a switch number 2. So that's switch 2's ID. We'll press Enter. And you'll notice it has a root port for instance 0 of MST, and also for instance 15 for the management. It also has a root port.

12:56And we also see the same thing for switch number 3. So if we take a look at switch number 3, let's go ahead and copy its switch ID here, and hit the up arrow key a couple of times, and then paste that ID in. It also has a root port, both for instance 0, and also for instance 15. So every non-root bridge, in this case, it's switch 2 and switch 3, they're going to have a root port that's doing forwarding towards the root bridge. And if we want to close that, we can see once again, right here, the graphical representation of that. So thanks for joining me in this discussion regarding FortiSwitch topologies and an overview of Spanning Tree Protocol.

13:30And I'll see you, my friend, in another video soon. Until then, I hope this has been informative, and I'd like to thank you for viewing.