------------------------------------------------------------------------------- Name: Management Interface Link status: Runtime link speed/duplex/state: 1000/full/up Configured link speed/duplex/state: auto/auto/auto MAC address: Port MAC address 50:00:00:57:00:00
Ip address: 192.168.10.91 Netmask: 255.255.255.0 Default gateway: 192.168.10.253 Ipv6 address: unknown Ipv6 link local address: fe80::5200:ff:fe57:0/64 Ipv6 default gateway: -------------------------------------------------------------------------------
VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Gi1/0/1, Gi1/0/2, Gi1/0/3 Gi1/0/4, Gi1/0/5, Gi1/0/6 Gi1/0/7, Gi1/0/8, Gi1/0/9 Gi1/0/10, Gi1/0/11, Gi1/0/12 Gi1/0/13, Gi1/0/14, Gi1/0/15 Gi1/0/16, Gi1/0/17, Gi1/0/18 Gi1/0/19, Gi1/0/20, Gi1/0/21 Gi1/0/22, Gi1/0/23, Gi1/0/24 Te1/1/1, Te1/1/2, Te1/1/3 Te1/1/4 4 VLAN0004 active 10 VLAN0010 active 20 VLAN0020 active
Switch#show ip int brie Interface IP-Address OK? Method Status Protocol Vlan1 unassigned YES NVRAM down down Vlan10 10.10.10.253 YES manual down down Vlan20 20.20.20.253 YES manual down down
4. 케이블 연결
5. LACP 확인
Switch#show etherchannel summary Flags: D - down P - bundled in port-channel I - stand-alone s - suspended H - Hot-standby (LACP only) R - Layer3 S - Layer2 U - in use f - failed to allocate aggregator
M - not in use, minimum links not met u - unsuitable for bundling w - waiting to be aggregated d - default port
A - formed by Auto LAG
Number of channel-groups in use: 1 Number of aggregators: 1
Group Port-channel Protocol Ports ------+-------------+-----------+----------------------------------------------- 1 Po1(SU) LACP Gi1/0/1(P) Gi1/0/2(P)
Switch#
6. Ping 테스트
Switch#ping 10.10.10.254 source vlan 10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.10.10.254, timeout is 2 seconds: Packet sent with a source address of 10.10.10.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/4 ms Switch#ping 20.20.20.254 sou Switch#ping 20.20.20.254 source vlan 20 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 20.20.20.254, timeout is 2 seconds: Packet sent with a source address of 20.20.20.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/4 ms Switch#
지금까지 fortigate인터페이스를 LACP설정하고 VLAN10 and VLAN20 interface 만들어서 Cisco Switch랑 통신 하는 방법에 대해서 알아보았습니다.
VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Gi1/0/2, Gi1/0/3, Gi1/0/4 Gi1/0/5, Gi1/0/6, Gi1/0/7 Gi1/0/8, Gi1/0/9, Gi1/0/10 Gi1/0/11, Gi1/0/12, Gi1/0/13 Gi1/0/14, Gi1/0/15, Gi1/0/16 Gi1/0/17, Gi1/0/18, Gi1/0/19 Gi1/0/20, Gi1/0/21, Gi1/0/22 Gi1/0/23, Gi1/0/24, Te1/1/1 Te1/1/2, Te1/1/3, Te1/1/4 4 VLAN0004 active 10 VLAN0010 active 20 VLAN0020 active 70 VLAN0070 active 71 VLAN0071 active 72 VLAN0072 active 73 VLAN0073 active 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup Switch#show ip int brie Interface IP-Address OK? Method Status Protocol Vlan1 unassigned YES NVRAM up up Vlan10 10.10.10.253 YES manual up up Vlan20 20.20.20.253 YES manual up up
5. Ping테스트
Switch#ping 10.10.10.254 source vlan 10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.10.10.254, timeout is 2 seconds: Packet sent with a source address of 10.10.10.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms Switch#ping 20.20.20.254 source vlan 20 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 20.20.20.254, timeout is 2 seconds: Packet sent with a source address of 20.20.20.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms
지금까지 방화벽 Port6에 VLAN interface를 생성해서 동작하는 방법에 대해서 알아보았습니다.
기본 설정은 위에 글을 참고 부탁드립니다. 이번 글에서 STP 설정에 대해서만 다루겠습니다.
1. Switch에서 G1/0/1 and G1/0/2를 Trunk를 설정 합니다.
interface GigabitEthernet1/0/1 switchport mode trunk end
Switch#show run int g1/0/2 Building configuration...
Current configuration : 61 bytes ! interface GigabitEthernet1/0/2 switchport mode trunk end
2. Fortigate에서 stp설정을 확인 합니다.
디폴트롤 STP enable입니다.
FortiGate-90G # config system interface
FortiGate-90G (interface) # edit lan
FortiGate-90G (lan) # show config system interface edit "lan" set vdom "root" set ip 192.168.1.99 255.255.255.0 set allowaccess ping https ssh fabric set type hard-switch set stp enable set role lan set snmp-index 15 next end
FortiGate-90G (lan) #
3. Switch에서 STP를 확인 합니다.
디폴트로 STP enable 입니다. 그리고 G1/0/2가 Blocking Port입니다.
Switch#show spanning-tree vlan 70
VLAN0070 Spanning tree enabled protocol rstp Root ID Priority 32838 Address 084f.a946.6900 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32838 (priority 32768 sys-id-ext 70) Address 084f.a946.6900 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/1 Desg FWD 4 128.1 P2p Gi1/0/2 Back BLK 4 128.2 P2p
Switch#show spanning-tree vlan 71
VLAN0071 Spanning tree enabled protocol rstp Root ID Priority 32839 Address 084f.a946.6900 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32839 (priority 32768 sys-id-ext 71) Address 084f.a946.6900 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/1 Desg FWD 4 128.1 P2p Gi1/0/2 Back BLK 4 128.2 P2p
Switch#show spanning-tree vlan 72
VLAN0072 Spanning tree enabled protocol rstp Root ID Priority 32840 Address 084f.a946.6900 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32840 (priority 32768 sys-id-ext 72) Address 084f.a946.6900 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/1 Desg FWD 4 128.1 P2p Gi1/0/2 Back BLK 4 128.2 P2p
Switch#show spanning-tree vlan 73
VLAN0073 Spanning tree enabled protocol rstp Root ID Priority 32841 Address 084f.a946.6900 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32841 (priority 32768 sys-id-ext 73) Address 084f.a946.6900 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/1 Desg FWD 4 128.1 P2p Gi1/0/2 Back BLK 4 128.2 P2p
Switch#
Switch#show run | in span spanning-tree mode rapid-pvst spanning-tree extend system-id
4. Ping테스트를 해보겠습니다.
정상적으로 동작 합니다.
Switch#ping 172.16.70.254 source vlan 70 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.70.254, timeout is 2 seconds: Packet sent with a source address of 172.16.70.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms Switch#ping 172.16.71.254 source vlan 71 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.71.254, timeout is 2 seconds: Packet sent with a source address of 172.16.71.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/4 ms Switch#ping 172.16.72.254 source vlan 72 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.72.254, timeout is 2 seconds: Packet sent with a source address of 172.16.72.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/4 ms Switch#ping 172.16.73.254 source vlan 73 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.73.254, timeout is 2 seconds: Packet sent with a source address of 172.16.73.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms Switch#
5. 포티넷 방화벽에서 port1 케이블을 제거 합니다.
6. Switch에서 STP상태를 확인 합니다.
Switch#show spanning-tree vlan 70
VLAN0070 Spanning tree enabled protocol rstp Root ID Priority 32838 Address 084f.a946.6900 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32838 (priority 32768 sys-id-ext 70) Address 084f.a946.6900 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/2 Desg FWD 4 128.2 P2p
Switch#show spanning-tree vlan 71
VLAN0071 Spanning tree enabled protocol rstp Root ID Priority 32839 Address 084f.a946.6900 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32839 (priority 32768 sys-id-ext 71) Address 084f.a946.6900 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/2 Desg FWD 4 128.2 P2p
Switch#show spanning-tree vlan 72
VLAN0072 Spanning tree enabled protocol rstp Root ID Priority 32840 Address 084f.a946.6900 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32840 (priority 32768 sys-id-ext 72) Address 084f.a946.6900 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/2 Desg FWD 4 128.2 P2p
Switch#show spanning-tree vlan 73
VLAN0073 Spanning tree enabled protocol rstp Root ID Priority 32841 Address 084f.a946.6900 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32841 (priority 32768 sys-id-ext 73) Address 084f.a946.6900 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Gi1/0/2 Desg FWD 4 128.2 P2p
Switch#
7. Ping 테스트를 합니다.
Switch#ping 172.16.70.254 source vlan 70 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.70.254, timeout is 2 seconds: Packet sent with a source address of 172.16.70.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/4 ms Switch#ping 172.16.71.254 source vlan 71 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.71.254, timeout is 2 seconds: Packet sent with a source address of 172.16.71.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/4 ms Switch#ping 172.16.72.254 source vlan 72 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.72.254, timeout is 2 seconds: Packet sent with a source address of 172.16.72.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms Switch#ping 172.16.73.254 source vlan 73 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.73.254, timeout is 2 seconds: Packet sent with a source address of 172.16.73.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms Switch#
Switch(config)#int vlan 70 Switch(config-if)#ip add 172.16.70.253 255.255.255.0 Switch(config-if)#no sh Switch(config-if)#int vlan 71 Switch(config-if)#ip add 172.16.71.253 255.255.255.0 Switch(config-if)#no sh Switch(config-if)#int vlan 72 Switch(config-if)#ip add 172.16.72.253 255.255.255.0 Switch(config-if)#no sh Switch(config-if)#int vlan 73 Switch(config-if)#ip add 172.16.73.253 255.255.255.0 Switch(config-if)#no sh Switch(config-if)# Switch(config-if)#end
2. 케이블을 연결 합니다.
Fortigate port1 <---> port 1/0/1 SW
3. SW설정값을 확인 합니다.
Switch#show vlan brie
VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Gi1/0/2, Gi1/0/3, Gi1/0/4 Gi1/0/5, Gi1/0/6, Gi1/0/7 Gi1/0/8, Gi1/0/9, Gi1/0/10 Gi1/0/11, Gi1/0/12, Gi1/0/13 Gi1/0/14, Gi1/0/15, Gi1/0/16 Gi1/0/17, Gi1/0/18, Gi1/0/19 Gi1/0/20, Gi1/0/21, Gi1/0/22 Gi1/0/23, Gi1/0/24, Te1/1/1 Te1/1/2, Te1/1/3, Te1/1/4 4 VLAN0004 active 70 VLAN0070 active 71 VLAN0071 active 72 VLAN0072 active 73 VLAN0073 active 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup Switch#
Switch#show ip int brie Interface IP-Address OK? Method Status Protocol Vlan1 unassigned YES NVRAM up up Vlan70 172.16.70.253 YES manual up up Vlan71 172.16.71.253 YES manual up up Vlan72 172.16.72.253 YES manual up up Vlan73 172.16.73.253 YES manual up up
4. 스위치에서 방화벽쪽으로 PING를 테스트 합니다.
Switch#ping 172.16.70.254 source vlan 70 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.70.254, timeout is 2 seconds: Packet sent with a source address of 172.16.70.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/4 ms Switch#ping 172.16.71.254 source vlan 71 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.71.254, timeout is 2 seconds: Packet sent with a source address of 172.16.71.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/4 ms Switch#ping 172.16.72.254 source vlan 72 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.72.254, timeout is 2 seconds: Packet sent with a source address of 172.16.72.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms Switch#ping 172.16.73.254 source vlan 73 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.73.254, timeout is 2 seconds: Packet sent with a source address of 172.16.73.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms Switch#
이번에는 포트를 변경해보겠습니다.
Fortigate port2 <-------> port1/0/1 SW
다시 Ping를 테스트 합니다.
Switch#ping 172.16.70.254 source vlan 70 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.70.254, timeout is 2 seconds: Packet sent with a source address of 172.16.70.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/4 ms Switch#ping 172.16.71.254 source vlan 71 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.71.254, timeout is 2 seconds: Packet sent with a source address of 172.16.71.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/4 ms Switch#ping 172.16.72.254 source vlan 72 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.72.254, timeout is 2 seconds: Packet sent with a source address of 172.16.72.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms Switch#ping 172.16.73.254 source vlan 73 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.73.254, timeout is 2 seconds: Packet sent with a source address of 172.16.73.253 .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms Switch#
VLAN-SWITCH에 포함된 PORT들은 아무 포트나 연결하면 VLAN 70 - IP, VLAN 71 - IP, VLAN 72 - IP, VLAN73 -IP랑 통신 가능 합니다.
VLAN-SWITCH<---> HARD-SWITCH랑 같습니다.
edit "lan" set vdom "root" set ip 192.168.1.99 255.255.255.0 set allowaccess ping https ssh fabric set type hard-switch set stp enable set role lan set snmp-index 15
