Wireless Access

 View Only
  • 1.  L2 VLAN probe

    Posted Dec 19, 2019 04:28 AM

    Does the clustered controller need to have an IP address on the VLAN to carry out the probes. Customer assures me the VLANs are enabled between the two controllers but they are showing L3 connected, and it seems all VLANs are reported as VLAN_FAIL - one at a time. When I exclude one and run the check again, another one is reported.

    HW controllers running 8.3.0.9



  • 2.  RE: L2 VLAN probe

    Posted Dec 19, 2019 04:48 AM

    It does NOT require an ip address on those VLANs.  Make sure all VLANs are trunked properly to the switch so that the controllers can "see" each other.



  • 3.  RE: L2 VLAN probe

    Posted Apr 28, 2020 05:05 AM

    Hello,

     

    seems that I have the same issue, did you found a solution on this?

    My end-customer also assures that all L2 is OK, but vlan probes are failing. 

    How do the vlan probes work exactly?

     

     



  • 4.  RE: L2 VLAN probe

    Posted Apr 28, 2020 05:51 AM

    Below a example of my configuration. As you can see only my management VLAN200 has an IP configured.

     

    200=Management

    201=Corporate

    202=Guest

     

    (HomeLAB-MM01) [00:0c:29:21:be:c2] #mdconnect

    (HomeLAB-MC01) [MDC] *#show ip interface brief

    Interface IP Address / IP Netmask Admin Protocol VRRP-IP
    vlan 200 172.16.200.31 / 255.255.255.0 up up
    vlan 1 unassigned / unassigned down down
    vlan 201 unassigned / unassigned up up
    vlan 202 unassigned / unassigned up up
    loopback unassigned / unassigned up up
    mgmt unassigned / unassigned down down

     

    When look at the configuration of my interface you see the switch port mode is "trunk".

    Where VLAN 200, 201, 202 are allowed, VLAN 200 is the native (untagged) VLAN and VLAN 201,202 are tagged.

     

    Last part you see all VLANS 1-4094 are trusted, what means this traffic doesn't need a firewall role and not hit the internal firewall to pass layer 2 traffic.

     

    # show configuration effective

    interface gigabitethernet 0/0/0
    description GE0/0/0
    switchport mode trunk
    switchport trunk allowed vlan 200-202
    switchport trunk native vlan 200
    no spanning-tree
    trusted
    trusted vlan 1-4094

     

    One side note, if you use a captive-portal for guest traffic, it must have an IP addres on each controller to reach the firewall for doing a DNS-Redirection. But that is another discussion...

     



  • 5.  RE: L2 VLAN probe

    Posted Apr 28, 2020 06:23 AM

    To answer your question, each member will unicast layer 2 probes on each of its VLANs to each of the other cluster members this will then determine if it is L2 connected. 

     

    If you run a port mirror on the port, do you see the unicast probe from the adjacent controller?



  • 6.  RE: L2 VLAN probe

    Posted Apr 28, 2020 07:47 AM

    great! I will try this.

    My end-customer has forti-switches and I think something got blocked there but they asked me how it exactly works, now they can start capturing some data



  • 7.  RE: L2 VLAN probe

    Posted Apr 28, 2020 07:57 AM

    @Thomasds wrote:

    Hello,

     

    seems that I have the same issue, did you found a solution on this?

    My end-customer also assures that all L2 is OK, but vlan probes are failing. 

    How do the vlan probes work exactly?

     

     


    Have the customer put ip addresses on the VLAN interfaces on the two controllers that have problems.  If they cannot ping each other, the customer did not setup the trunk right.  That is the easiest way to test that.



  • 8.  RE: L2 VLAN probe

    Posted Apr 28, 2020 08:08 AM

    already tried that part otherwise it would be easy

    If I configure an IP, ping is working fine, also clients in the same vlan but on other controllers can reach each other. The cluster is just staying in L3, and when I check the vlan probe I can see it is failing, when when I exclude the vlan which is giving the probe fail, I just see a new vlan with the probe fail and this keeps on going until I exclude all vlans



  • 9.  RE: L2 VLAN probe

    Posted Apr 28, 2020 08:22 AM

    @Thomasds wrote:

    when I exclude the vlan which is giving the probe fail, I just see a new vlan with the probe fail and this keeps on going until I exclude all vlans


    Time to open a Technical Support case.



  • 10.  RE: L2 VLAN probe

    Posted Apr 28, 2020 08:32 AM

    I don't like that part

     

    First checking with the LAN provider if their fortiswitches are not blocking things. And then indeed opening a ticket with TAC

     

    And just to be sure: it's a valid configuration that the mgmtvlan is on port GE0/0/3 and the uservlans on port GE0/0/2  ? or should they all be on the same port ?



  • 11.  RE: L2 VLAN probe

    Posted Apr 28, 2020 08:38 AM

    They are not required to be on the same port.