topic Re: 5420 EXOS automatic VLAN creation when connected to Fortigate Firewall in ExtremeSwitching (EXOS/Switch Engine)

5420 EXOS automatic VLAN creation when connected to Fortigate Firewall

Nico_Lueck — Tue, 14 Dec 2021 17:36:05 GMT

Hi all,

today I was setting up a new customer location (Fortigate, 5420 Exos and some APs).
First off all I figured out the Fortigate (LAN1 will be the uplink to 5420 Port 1).
LAN1 of Fortigate do have 4 tagged VLANs.

Now the switch is connected and have default configuration.
I was wondering why all the 4 VLANs which are configrued on fortigate lan1 are automaticly configured on the 5420 ?

Is there a new feature?

Already checked some standard features like lldp, but can't figure out where it comes from.

Default FW version is 31.3.1.3 patch1-7

thanks!

Re: 5420 EXOS automatic VLAN creation when connected to Fortigate Firewall

Miguel-Angel_RO — Wed, 15 Dec 2021 12:59:36 GMT

Hi nico,

This is interesting. Fortinet as a kind of "Fabric" and I'm wondering if they based this on the auto-attach RFC (802.1Qcj) used for the Fabric-Attach.
Could you on the EXOS the FA status?

show fabric attach assignments

show fabric attach elements

show port 1 vlan
sh lldp port 1 neighbors detailed

Thanks
Mig

Re: 5420 EXOS automatic VLAN creation when connected to Fortigate Firewall

Ludovico_Steven — Wed, 15 Dec 2021 13:07:31 GMT

Maybe you had defined the VLANs on XIQ-SE (XMC) and you onboarded the EXOS switch via ZTP+ ? Then the site VLANs will get created automatically on the switch.

Re: 5420 EXOS automatic VLAN creation when connected to Fortigate Firewall

Gabriel_G — Wed, 15 Dec 2021 18:40:16 GMT

This was most likely ZTP or ZTP+.

ZTP (auto-provisioning) starts automatically on a factory default bootup and detects attached VLANs based on the tags of incoming traffic. The switch dynamically creates and assigns these VLANs and enables DHCP on them in an attempt to connect to the network without configuration.

ZTP+ is an extension of this whereby you can use DNS entries and/or DHCP options to point the switch to a full configuration.

Regardless, those VLANs were probably detected based on incoming traffic, and if your FW is hosting DHCP, the switch probably got a few IP addresses. If you want to stop this behavior, 'disable auto-provision' on startup. ZTP does not take effect on a switch that's already been configured/saved; only on factory default bootup.

I'm not sure when this feature was introduced but it's been a while.

Hope that helps!
Gabriel

Re: 5420 EXOS automatic VLAN creation when connected to Fortigate Firewall

Nico_Lueck — Thu, 16 Dec 2021 09:57:11 GMT

Thanks @Gabriel_G

Already found that deactivating the auto-provisioning stops it.

Normal behavier of course is to configured the switch first and afterward connecting to the network.
So thats may be the reason why I saw that for the first time.

So I'm wondering how it works.

Is the switch sending a dhcp discover on every vlan (1-4096) and after getting an answer he will create that vlan?

Thanks a lot.

Regards
Nico

Re: 5420 EXOS automatic VLAN creation when connected to Fortigate Firewall

Ludovico_Steven — Thu, 16 Dec 2021 11:29:01 GMT

>Is the switch sending a dhcp discover on every vlan (1-4096) and after getting an answer he will create that vlan?

Yes, that is correct, EXOS does that. Up to 4095 though, and untagged as well of course.

Re: 5420 EXOS automatic VLAN creation when connected to Fortigate Firewall

Gabriel_G — Thu, 16 Dec 2021 23:01:12 GMT

>Is the switch sending a dhcp discover on every vlan (1-4096) and after getting an answer he will create that vlan?

Contrary to Ludovico (no offense, and I could be wrong), my understanding is that EXOS detects attached VLANs based on incoming traffic with VLAN tags, dynamically creates those VLANs and assigns them to relevant ports, and sends a DHCP discover on them.

I can confirm that this will happen regardless of if the VLAN is tagged or untagged, that is certain.

I'm not sure if the switch actually tests every single VLAN or just detects incoming VLANs, but I believe it is the latter.

Re: 5420 EXOS automatic VLAN creation when connected to Fortigate Firewall

Ludovico_Steven — Fri, 17 Dec 2021 16:33:22 GMT

I took a wireshark of an EXOS doing ZTP; see for your selves.
The switch in question was rebooted with "unconfigure switch".
https://extremenetworks2com-my.sharepoint.com/:u:/g/personal/lstevens_extremenetworks_com/EWnzkG1BlxJAgQl2O3YeA38B_59KRb4gSIIFQxnCRhNEGw?e=y7dMLN

Re: 5420 EXOS automatic VLAN creation when connected to Fortigate Firewall

Gabriel_G — Fri, 17 Dec 2021 17:11:53 GMT

I Stand Corrected,

Thanks for confirming Ludovico!

Re: 5420 EXOS automatic VLAN creation when connected to Fortigate Firewall

Nico_Lueck — Mon, 20 Dec 2021 10:27:46 GMT

@Ludovico Stevens

great, thanks a lot for the wireshark dump!

Wish you all a very mary christmas and all the best for 2022!

Regards
Nico