Fortinet FortiSwitch-5003B System Manual

Page 1

FortiSwitch-5003B

System Guide

This FortiSwitch-5003B System Guide describes FortiSwitch-5003B hardware features, how to install a FortiSwitch-5003B board in a FortiGate-5000 series chassis, and how to configure the FortiSwitch-5003B system for your network.

The most recent versions of this and all FortiGate-5000 series documents are available from the FortiGate-5000 page of the Fortinet Technical Documentation web site (http://docs.fortinet.com).

Access to Fortinet customer services, such as firmware updates, support, and FortiGuard services, requires product registration. You can register your FortiSwitch-5003B at http://support.fortinet.com.

FortiSwitch-5003B System Guide

01-400-134822-20120216

Page 2

Warnings and cautions

Only trained and qualified personnel should be allowed to install or maintain FortiGate-5000 series equipment. Read and comply with all warnings, cautions and notices in this document.

• Risk of Explosion if Battery is replaced by an Incorrect Type. Dispose of Used Batteries According to the Instructions.

• Turning off all power switches may not turn off all power to the FortiGate-5000 series equipment. Some circuitry in the FortiGate-5000 series equipment may continue to operate even though all power switches are off.

• FortiGate-5000 equipment must be protected by a readily accessible disconnect device or circuit breaker that can be used for product power down emergencies.

• Many FortiGate-5000 components are hot swappable and can be installed or removed while the power is on. But some of the procedures in this document may require power to be turned off and completely disconnected. Follow all instructions in the procedures in this document that describe disconnecting FortiGate-5000 series equipment from power sources, telecommunications links and networks before installing, or removing FortiGate-5000 series components, or performing other maintenance tasks. Failure to follow the instructions in this document can result in personal injury or equipment damage.

• Install FortiGate-5000 series chassis at the lower positions of a rack to avoid making the rack top-heavy and unstable.

• Do not insert metal objects or tools into open chassis slots.

• Electrostatic discharge (ESD) can damage FortiGate-5000 series equipment. Only perform the procedures described in this document from an ESD workstation. If no such station is available, you can provide some ESD protection by wearing an anti-static wrist strap and attaching it to an available ESD connector such as the ESD sockets provided on FortiGate-5000 series chassis.

• Make sure all FortiGate-5000 series components have reliable grounding. Fortinet recommends direct connections to the building ground.

• If you install a FortiGate-5000 series component in a closed or multi-unit rack assembly, the operating ambient temperature of the rack environment may be greater than room ambient. Make sure the operating ambient temperature does not exceed Fortinet’s maximum rated ambient temperature.

• Installing FortiGate-5000 series equipment in a rack should be such that the amount of airflow required for safe operation of the equipment is not compromised.

• FortiGate-5000 series chassis should be installed by a qualified electrician.

• FortiGate-5000 series equipment shall be installed and connected to an electrical supply source in accordance with the applicable codes and regulations for the location in which it is installed. Particular attention shall be paid to use of correct wire type and size to comply with the applicable codes and regulations for the installation / location. Connection of the supply wiring to the terminal block on the equipment may be accomplished using Listed wire compression lugs, for example, Pressure Terminal Connector made by Ideal Industries Inc. or equivalent which is suitable for AWG-10. Particular attention shall be given to use of the appropriate compression tool specified by the compression lug manufacturer, if one is specified.

• This product is only intended for use in a Restricted Access Location.

FortiSwitch-5003B System Guide

01-400-134822-20120216

http://docs.fortinet.com/

Page 3

FortiSwitch-5003B

Contents

Warnings and cautions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

FortiSwitch-5003B system 5

Physical description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Front panel components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

About the SH1 and SH2 LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Fabric channel interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

More about Fabric backplane interfaces and chassis slots . . . . . . . . . . . . 11

Base channel interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Front panel connectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

FortiSwitch-5003B configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Base and fabric switching within a chassis . . . . . . . . . . . . . . . . . . . . 14

Fabric 10-gigabit switching within a chassis. . . . . . . . . . . . . . . . . . . . 15

Enhanced Load Balance Clustering (ELBC) . . . . . . . . . . . . . . . . . . . . . . 15

Hardware installation 17

Installing SFP+ transceivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Changing FortiSwitch-5003B SW2 switch settings . . . . . . . . . . . . . . . . . . 18

FortiSwitch-5003B mounting components . . . . . . . . . . . . . . . . . . . . . . . 20

Inserting a FortiSwitch-5003B board . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Shutting down and removing a FortiSwitch-5003B board . . . . . . . . . . . . . . . 24

Power cycling a FortiSwitch-5003B board . . . . . . . . . . . . . . . . . . . . . . . 26

Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

FortiSwitch-5003B does not startup . . . . . . . . . . . . . . . . . . . . . . . . 27

FortiSwitch-5003B status LED is flashing during system operation . . . . . . . . 27

Quick Configuration Guide 29

Registering your Fortinet product . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Factory default settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Basic configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Web-based Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Upgrading FortiSwitch-5000 series firmware . . . . . . . . . . . . . . . . . . . . . 32

FortiSwitch-5003B System Guide 01-400-134822-20120216 3

http://docs.fortinet.com/

Page 4

Contents

Additional configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Disabling the front panel F8 interface and enabling the fabric

backplane interconnect (slot-1/2) . . . . . . . . . . . . . . . . . . . . . . . . . 33

Disabling the front panel F8 interface and enabling the slot-14

fabric interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Changing the system time and host name. . . . . . . . . . . . . . . . . . . . . 34

Changing the switch fabric-channel configuration. . . . . . . . . . . . . . . . . 34

For more information 35

Training Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Technical Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Comments on Fortinet technical documentation . . . . . . . . . . . . . . . . . 35

Customer service and support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Fortinet products End User License Agreement . . . . . . . . . . . . . . . . . . . . 35

4 01-400-134822-20120216

FortiSwitch-5003B System Guide

http://docs.fortinet.com/

Page 5

FortiSwitch-5003B

FortiSwitch-5003B system

The FortiSwitch-5003B board is an Advanced Telecommunications Computing Architecture (ATCA) compliant hub/switch board that provides 10-gigabit fabric and 1-gigabit base backplane channel layer-2 switching in a dual star architecture. The FortiSwitch-5003B board provides a total capacity of 225 Gigabits per second (Gbps) throughput.

The FortiSwitch-5003B board can be installed in any ATCA chassis that can provide sufficient power and cooling. You can install FortiSwitch-5003B boards in a FortiGate-5060 chassis and in selected versions of the NEBS-compliant FortiGate-5140-R chassis. Table 1 lists FortiGate-5000 series chassis that can support the FortiSwitch-5003B board. For most up-to-date list of all chassis that can support the FortiSwitch-5003B board see the FortiSwitch-5003B Release Notes.

Table 1: FortiGate-5000 series chassis that support the FortiSwitch-5003B board

Chassis Model

FG-5140B C4GL51-01BD-0000 P09297-01 FG514B3Y12000xxx

FG-5060 C4FN27-01AA-0000 P08588-01 FG50603S1XXXXXXX

FG-5140 C4GL51-01BC-0000 P05355-01 FG51403S0900000X

FG-5140 C4GL51-02BC-0000 P05355-02 FG51403S090010XX

FG-5140 C4DH67-01AA-0000 P05853-01 FG51403S090020XX

FG-5140 C4DH67-02AA-0000 P05853-02 FG51403S1003XXXX

In all ATCA chassis FortiSwitch-5003B boards are installed in the first and second hub/switch slots. For most versions of FortiGate chassis the hub/switch slots are slots 1 and 2. For more information about FortiGate-5000 series chassis see the FortiGate-5000

Chassis Guides page of the Fortinet Technical Documentation web site.

You can use the FortiSwitch-5003B board for fabric and base backplane layer-2 switching for FortiGate-5000 boards installed in slots 3 and up in FortiGate-5140 and FortiGate-5060 chassis. Usually you would use the base channel for management traffic (for example, HA heartbeat traffic) and the fabric channel for data traffic. FortiSwitch-5003B boards can be used for fabric and base backplane layer-2 switching within a single chassis and between multiple chassis.

The FortiSwitch-5003B system also supports LACP (802.3ad) link aggregation, 802.1q VLANs, and 802.1s Multiple Spanning Tree Protocol (MSTP) for the fabric channels. You can use these features to configure link aggregation and support redundant FortiSwitch-5003B switch configurations to distribute traffic to multiple FortiGate-5000 boards. The FortiGate-5000 boards can operate in NAT/Route or Transparent mode.

Hardware ID System Part Number Serial Number

FortiSwitch-5003B System Guide 01-400-134822-20120216 5

http://docs.fortinet.com/

Page 6

Figure 1: FortiSwitch-5003B front panel

1/2 to 14 Base Network

Activity LEDs

1/2 to 14 Fabric

Network Activity LEDs

Factory Use

RJ-45

Console

10 Gig Fibre Channel

F1 to F8

SFP+ Interfaces

FortiSwitch-5003B system

B1 and B2

10 Gig Base Channel

SFP+ Interfaces

IPM LED

(board

position)

Retention

Screw

Extraction

Lever

OOS LED

PWR LED

STA LED

ACC LED

MGMT

10/100/1000 Copper

Management Interface

Retention

Screw

Extraction

Lever

A FortiSwitch-5003B board in hub/switch slot 1 provides communications on fabric channel 1 and base channel 1. A FortiSwitch-5003B board in hub/switch slot 2 provides communications on fabric channel 2 and base channel 2. If your chassis includes one FortiSwitch-5003B board you can install it in hub/switch slot 1 or 2 and configure the FortiGate-5000 boards installed in the chassis to use the correct fabric and base backplane interfaces.

For a complete 10-gigabit fabric backplane solution you must install FortiGate-5000 hardware that supports 10-gigabit connections. For example:

• FortiGate-5001B boards include 10-gigabit fabric backplane interfaces. You can install the FortiGate-5001B boards in chassis slots 3 and up.

• FortiGate-5001A boards must be combined with FortiGate-RTM-XB2 or FortiGateRTM-XD2 modules to support 10-gigabit fabric interfaces. You can install the FortiGate-5001A boards in chassis slots 3 and up and FortiGate-RTM-XB2 or FortiGate-RTM-XD2 modules in the corresponding RTM slots on the back of the chassis.

The FortiSwitch-5003B board includes the following features:

• One 1-gigabit base backplane channel for layer-2 base backplane switching between FortiGate-5000 series boards installed in the same chassis as the FortiSwitch-5003B board. The base backplane channel includes 13 1-gigabit connections to up to 13 other slots in the chassis (Slots 2 to 14 if the FortiSwitch-5003B board is installed in slot 1. Slots 1 and 3 to 14 if the FortiSwitch-5003B board is installed in slot 2.).

• One 10-gigabit fabric backplane channel for layer-2 fabric backplane switching between FortiGate-5001B boards installed in the same chassis as the FortiSwitch-5003B board. The fabric backplane channel includes 13 10-gigabit connections to up to 13 other slots in the chassis (Slots 2 to 14 if the FortiSwitch-5003B board is installed in slot 1. Slots 1 and 3 to 14 if the FortiSwitch-5003B board is installed in slot 2.).

By default, FortiSwitch-5003B boards with part numbers lower than P11000-01 could not connect to the 14th fabric channel slot interface without deactivating the F8 front panel interface. See “Disabling the front panel F8 interface and enabling the slot-14

fabric interface” on page 33.

• Two front panel base backplane 10-gigabit SFP+ interfaces (B1 and B2) that connect to the base backplane channel. These interfaces can also be configured to operate as 1-gigabit SFP interfaces.

6 01-400-134822-20120216

FortiSwitch-5003B System Guide

http://docs.fortinet.com/

Page 7

FortiSwitch-5003B system Physical description

• Eight front panel fabric backplane 10-gigabit SFP+ interfaces (F1 to F8) that connect to the fabric backplane channel. These interfaces can also be configured to operate as 1-gigabit SFP interfaces.

By default on FortiSwitch-5003B boards with part number P11000-01 and up the F8 interface is activated but it can be deactivated (see “Disabling the front panel F8

interface and enabling the fabric backplane interconnect (slot-1/2)” on page 33).

• One 1-gigabit dedicated management Ethernet interface (MGMT). This interface is for management purposes only and cannot forward traffic.

• One RJ-45, RS-232 serial console connection (CONSOLE).

• Mounting hardware.

• LED status indicators.

• IEEE 802.1q VLANs.

• IEEE 802.3ad link aggregation (LACP).

• Link aggregation using a hash algorithm based on source and destination IP addresses.

• Multiple Spanning Tree Protocol (MSTP) (IEEE 802.1s) to support redundant FortiSwitch-5003B boards and external MSTP-compatible switches.

• Heartbeat between a FortiGate-5000 board and the FortiSwitch-5003B board over the fabric channel.

• Standard FortiOS web-based manager and command line interface (CLI) for configuring fabric switch settings (VLANs, MSTP, trunks, and so on).

Physical description

Table 2: FortiSwitch-5003B board physical description

Dimensions

Weight 8.6 lb. (3.9 kg)

Operating Temperature 32 to 104°F (0 to 40°C)

Storage Temperature -13 to 158°F (-35 to 70°C)

Relative Humidity 5 to 90% (Non-condensing)

Power consumption Maximum: 180WDC; Average: 150WDC

Max Current 3.75A

Heat Dissipation 614BTU/h

Front panel components

From the FortiSwitch-5003B font panel you can view the status of the board LEDs to verify that the board is functioning normally.

The front panel also contains connectors to the fabric and base channels, an out of band management Ethernet interface, and an RJ-45 RS-232 console port for connecting to the FortiSwitch-5003B CLI.

1.2 x 11.7 x 13.8 in. (3.1 x 29.6 x 35.1 cm) (Height x Width x Depth)

FortiSwitch-5003B System Guide 01-400-134822-20120216 7

http://docs.fortinet.com/

Page 8

Front panel components FortiSwitch-5003B system

Table 3: FortiSwitch-5003B front LEDs

LED State Description

Green Fabric backplane interface is connected at 10 Gbps or

1 Gbps.

Fabric (1/2 to 14)

Flashing Green

Network activity at the fabric backplane interface.

Off No link is established.

Green Base backplane interface is connected at 1 Gbps.

Base (1/2 to 14)

Flashing Green

Network activity at the base backplane interface.

Off No link is established.

Off Normal operation.

OOS (Out of Service)

Amber A fault condition exists and the FortiSwitch-5003B blade

is out of service (OOS). This LED may also flash very briefly during normal startup.

PWR (Power) Green The FortiSwitch-5003B board is powered on.

Off The FortiSwitch-5003B board is powered on.

STA (Status)

Flashing Green

The FortiSwitch-5003B is starting up. If this LED is flashing at any time other than system startup, a fault condition may exist.

Off or Flashing green

ACC (Disk activity)

The ACC LED flashes green when the FortiSwitch-5003B board accesses the flash disk. The flash disk stores the current firmware build and configuration files. The system accesses the flash disk when starting up, during a firmware upgrade, or when an administrator is using the CLI or GUI to change the FortiSwitch-5003B configuration. Under normal operating conditions this LED flashes occasionally, but is mostly off.

SH1

SH2

Not used in the default configuration. See “About the SH1 and SH2

LEDs” on page 9.

Green or Flashing Green

Network activity between the FortiSwitch-5003B board and one of the shelf managers across the chassis backplane. If the FortiSwitch-5003B board is installed in chassis slot 1, this LED indicates a connection to shelf manager 2. If the FortiSwitch-5003B board is installed in chassis slot 2, this LED indicates a connection to shelf manager 1.

Green The correct cable is connected to the fabric channel

interface and the connected equipment has power.

F1 to F8

Flashing

Network activity at the fabric channel interface.

Green

Off No link is established.

8 01-400-134822-20120216

FortiSwitch-5003B System Guide

http://docs.fortinet.com/

Page 9

FortiSwitch-5003B system Front panel components

Table 3: FortiSwitch-5003B front LEDs (Continued)

LED State Description

Green The correct cable is connected to the base channel

interface and the connected equipment has power.

B1 and B2

Flashing

Network activity at the base channel interface.

Green

Off No link is established.

Link/Act (Left LED)

Solid Green

Blinking

Indicates this interface is connected with the correct cable and the attached network device has power.

Indicates network traffic on this interface.

Green

MGMT

Speed (Right LED)

Off No Link

Green Connection at 1 Gbps.

Amber Connection at 100 Mbps.

Off Connection at 10 Mbps.

The unlabeled interface beside the MGMT interface is not used.

Blue The FortiSwitch-5003B is ready to be hot-swapped

(removed from the chassis). If the IPM light is blue and no other LEDs are lit the FortiSwitch-5003B board has lost power

IPM

Flashing Blue

The FortiSwitch-5003B is changing from hot swap to running mode or from running mode to hot swap. This happens when the FortiSwitch-5003B board is starting up or shutting down.

Off Normal operation. The FortiSwitch-5003B board is in

contact with the chassis backplane. (If the chassis does not contain an operating shelf manager, this LED being off just indicates normal operation.)

About the SH1 and SH2 LEDs

SH1 and SH2 are base channel interfaces that can be used to connect the FortiSwitch-5003B board to the chassis shelf managers over the chassis backplane. The SH1 and SH2 LEDs indicate the status of the connections between the FortiSwitch-5003B board and the shelf manager.

• In most chassis if a FortiSwitch-5003B board is installed in slot 1 the SH1 LED will light if the board can communicate with the shelf manager in shelf manager slot 1 and the SH2 LED will light if the board can communicate with a shelf manager in shelf manager slot 2.

• In most chassis if a FortiSwitch-5003B board is installed in slot 2 the SH1 LED will light if the board can communicate with the shelf manager in shelf manager slot 2 and the SH2 LED will light if the board can communicate with a shelf manager in shelf manager slot 1.

FortiSwitch-5003B System Guide 01-400-134822-20120216 9

http://docs.fortinet.com/

Page 10

Front panel components FortiSwitch-5003B system

Whether or not these LEDs are lit depends on the configuration of the SH1 and SH2 interfaces on the FortiSwitch-5003B board, the configuration of the chassis backplane, the ATCA chassis that the boards are installed in, and if one or both shelf managers are installed and configured to connect using the backplane or their front panel Ethernet interfaces.

Fabric channel interfaces

Table 4 lists and describes the FortiSwitch-5003B fabric channel interfaces. You can

configure fabric interface settings, group fabric interfaces into trunks, and configure Multiple Spanning Tree Protocol (MSTP) for fabric interfaces from the FortiSwitch-5003B web-based manager or CLI (see “Changing the switch fabric-channel configuration” on

page 34).

Table 4: Fabric channel interfaces

Interface Name

Front Panel

CLI*

1/2 f8/slot-1/2

3 to 14

F1 to F7

slot-3 to slot-14

f1 to f7/xchannel

F8 f8/slot-1/2

* You can configure settings for FortiSwitch-5003B fabric interfaces from the FortiSwitch-5003B CLI. The CLI columns show the names of the interfaces as they appear on the FortiSwitch-5003B CLI.

Description

Interconnection interface between fabric channels 1 and 2. If there are two FortiSwitch-5003B boards installed in a chassis this interface can be used to communicate between them.

This interface shares the same switch port as the front panel F8 interface and is deactivated by default. The FortiGate5060 fabric backplane is a triply-replicated mesh that results in additional connections between FortiSwitch-5003B boards installed in the same chassis. See “More about Fabric

backplane interfaces and chassis slots” on page 11.

Fabric backplane slots 3 to 14.

The 3 to 14 fabric network activity LEDs are lit if there are FortiGate boards in chassis slots 3 to 14.

Front panel 10-gigabit fabric interfaces F1 to F7.

Use these interfaces to connect your network to the fabric channel, to connect fabric channel 1 to fabric channel 2, or to connect a fabric channel on one chassis to a fabric channel on another chassis.

F7/x-channel can be switched between the F7 interface and the x-channel interface. By default this interface is set to F7 and the x-channel interface is not normally used.

Front panel interface F8. Fabric backplane interconnection interface slot 1/2 and front panel interface F8 share the same FortiSwitch-5003B switch port. By default the front panel interface F8 is activated and fabric backplane interconnection interface slot 1/2 is deactivated.

The fabric network activity LEDs show links and network activity for the interfaces and connections listed in Table 5.

10 01-400-134822-20120216

FortiSwitch-5003B System Guide

http://docs.fortinet.com/

Page 11

FortiSwitch-5003B system Front panel components

Table 5: Fabric network activity LEDs

Fabric network

Interface or connection

activity LED

Interconnection interface between fabric channels 1 and 2. This LED is

1/2

lit if there are two FortiSwitch-5003B boards installed in the chassis to indicate fabric backplane communication between them.

3 to 14

Fabric backplane connection to FortiGate-5000 boards in chassis slots 3 to 14.

More about Fabric backplane interfaces and chassis slots

The FortiSwitch-5003B board supports up to slots for 13 connections to the fabric backplane. Normally these slots correspond to one connection between switch/hub slots (slot-1/2) and then 12 more connections to the 12 node slots in an ATCA chassis (slot-3 to slot-14). For example, in a FortiGate-5140-series chassis, slot-3 to slot-14 correspond to the 12 chassis node slots numbered 3 to 14 (see Table 6).

Table 6: FortiSwitch-5003B backplane mapping with a FortiGate-5140-series chassis

FortiSwitch-5003B Fabric Port Name

Actual connection in a FortiGate-5140 chassis

slot-1/2 Connection between chassis slot 1 and slot 2.

slot-3 Connection to chassis slot 3.

slot-4 Connection to chassis slot 4.

slot-5 Connection to chassis slot 5.

slot-6 Connection to chassis slot 6.

slot-7 Connection to chassis slot 7.

slot-8 Connection to chassis slot 8.

slot-9 Connection to chassis slot 9.

slot-10 Connection to chassis slot 10.

slot-11 Connection to chassis slot 11.

slot-12 Connection to chassis slot 12.

slot-13 Connection to chassis slot 13.

slot-14 Connection to chassis slot 14.

Normally in a chassis with less than 12 node slots the extra fabric backplane interfaces are not active. For example, in an ATCA chassis with 5 slots, slot-1/2 provides the connections between chassis slots 1 and 2 and slot-3 to slot-5 connect to chassis node slots 3 to 5. In this 5-slot chassis, slot-6 to slot-14 would not be connected (see Table 7).

Table 7: FortiSwitch-5003B backplane mapping with an example 5-slot chassis

FortiSwitch-5003B Fabric Port Name

slot-1/2 Connection between chassis slot 1 and slot 2.

slot-3 Connection to chassis slot 3.

FortiSwitch-5003B System Guide 01-400-134822-20120216 11

http://docs.fortinet.com/

Actual connection in 5-slot ATCA chassis

Page 12

Front panel components FortiSwitch-5003B system

Table 7: FortiSwitch-5003B backplane mapping with an example 5-slot chassis

FortiSwitch-5003B Fabric Port Name

Actual connection in 5-slot ATCA chassis

slot-4 Connection to chassis slot 4.

slot-5 Connection to chassis slot 5.

slot-6 Not connected.

slot-7 Not connected.

slot-8 Not connected.

slot-9 Not connected.

slot-10 Not connected.

slot-11 Not connected.

slot-12 Not connected.

slot-13 Not connected.

slot-14 Not connected.

The FortiGate-5060 fabric backplane is a triply-replicated 6-slot mesh resulting in connections after the slot-6 interface being mapped to slot-7 and up as shown in Table 8.

Table 8: FortiSwitch-5003B backplane mapping with a FortiGate-5060 chassis

FortiSwitch-5003B Fabric Port Name

Actual connection in a FortiGate-5060 chassis

slot-1/2 Connection between chassis slot 1 and slot 2.

slot-3 Connection to chassis slot 3.

slot-4 Connection to chassis slot 4.

slot-5 Connection to chassis slot 5.

slot-6 Connection to chassis slot 6.

slot-7 Secondary connection between chassis slot 1 and slot 2.

slot-8 Secondary connection to chassis slot 3.*

slot-9 Secondary connection to chassis slot 4.*

slot-10 Secondary connection to chassis slot 5.*

slot-11 Secondary connection to chassis slot 6.*

slot-12 Tertiary connection between chassis slot 1 and slot 2.*

slot-13 Tertiary connection to chassis slot 3.*

slot-14 Tertiary connection to chassis slot 4.*

*Current FortiSwitch-5003B series boards do not support the secondary and tertiary connections.

If a FortiGate-5060 chassis contains two FortiSwitch-5003B boards, connections between them can occur using slot-7, slot-12, and may occur using slot-1/2 if this interface is activated. These connections between the FortiSwitch-5003B boards in the same chassis have the potential to cause looping. However, by default the FortiSwitch-5003B board has MSTP enabled on all interfaces which prevents looping.

In some configurations you may need to disable MSTP. Before disabling MSTP you should disable the slot-7, slot-12 and slot-1/2 interfaces.

12 01-400-134822-20120216

FortiSwitch-5003B System Guide

http://docs.fortinet.com/

Page 13

FortiSwitch-5003B system Front panel components

Entering the following commands from the FortiSwitch-5003B CLI will disable the slot-7, slot-12 and slot-1/2 fabric channel interfaces. You do not have to disable f8/slot-1/2 interface if the active connection is set to F8.

config switch fabric-channel physical-port

edit slot-7

set status down next edit slot-12

set status down next edit f8/slot-1/2

set status down next

end

Base channel interfaces

Table 9: Base channel interfaces and network activity LEDs

Interface Name

Front Panel

SH1 and SH2

1/2

CLI*

sh1 and sh2

slot1/2

slot-3

3 to 14

to slot-14

B1 and B2

b1 and b2

* You can configure settings for FortiSwitch-5003B base interfaces from the FortiSwitch-5003B CLI. The CLI columns show the names of the interfaces as they appear on the FortiSwitch-5003B CLI.

Description

Interface for backplane connection between FortiSwitch-5003B board and shelf manager 1 (SH1) or shelf manager 2 (SH2).

This LED may not be lit even if a shelf manager is present if the shelf manager is configured to use its front panel interface.

Interconnection interface between base channels 1 and 2. This LED is lit only if a chassis contains two FortiSwitch-5003B boards in slots 1 and 2.

Base channel connection to FortiGate-5000 boards in chassis slots 3 to 14.

Front panel SFP+ base channel interfaces B1 and B2.

Use these interfaces to connect your network to the base channel, to connect base channel 1 to base channel 2, or to connect a base channel on one chassis to a base channel on another chassis.

Front panel connectors

Table 10: FortiSwitch-5003B connectors

Connector Type Speed Protocol Description

CONSOLE

USB USB Not used.

FortiSwitch-5003B System Guide 01-400-134822-20120216 13

http://docs.fortinet.com/

RJ-45 9600 bps

8/N/1

RS-232 serial

Serial connection to the command line interface.

Page 14

FortiSwitch-5003B configurations FortiSwitch-5003B system

Table 10: FortiSwitch-5003B connectors

Connector Type Speed Protocol Description

F1 to F8

SFP+ (10 gigabit) or SPF (1 gigabit)

10-gigabit full 1-gigabit auto 1-gigabit full

Ethernet 10-gigabit SPF+ connection to

10-gigabit network or 1-gigabit SPF connection to 1-gigabit network. Small form-factor pluggable transceiver.

B1 and B2

SFP+ (10 gigabit) or SPF (1 gigabit)

10-gigabit full 1-gigabit auto 1-gigabit full

Ethernet 10-gigabit SPF+ connection to

10-gigabit network or 1-gigabit SPF connection to 1-gigabit network. Small form-factor pluggable transceiver.

RJ-45 10/100/1000

Base-T

Ethernet Copper 1-gigabit connection to

10/100/1000Base-T copper networks for management or system administration. The

MGMT

unlabeled interface beside the MGMT interface is not used. Its LEDs may be lit in some cases but the stat of these LEDs can be ignored.

FortiSwitch-5003B configurations

You can operate the FortiSwitch-5003B board as a fabric and base channel layer-2 switch for any FortiGate-5000 board that has base and fabric channel connectivity. The FortiSwitch-5003B board is compatible with all FortiGate-5000 boards.

Base and fabric switching within a chassis

Figure 2 represents a FortiSwitch-5003B board in slot 1 and two FortiGate-5001B boards

in slots 3 and 4 in a chassis (for clarity the chassis is not shown). In this configuration the FortiGate-5001B boards use base channel 1 for HA heartbeat communication. The FortiGate-5001B boards are configured to use base1 as the HA heartbeat interface.

Figure 2: FortiSwitch-5003B base channel 1 HA heartbeat communication

Base channel 1 HA Heartbeat Communication

FABRIC

1/2

1410

BASE

1/2

1410

SH1

SH2

SFP+

B1 B2

FortiSwitch 5203B

Slot 4

Slot 3

Slot 1

14 01-400-134822-20120216

FortiSwitch-5003B System Guide

http://docs.fortinet.com/

Page 15

FortiSwitch-5003B system Enhanced Load Balance Clustering (ELBC)

Fabric 10-gigabit switching within a chassis

Figure 3 represents two FortiSwitch-5003B boards installed in slots 1 and 2 and a

FortiGate-5001B board installed in slot 4 in a chassis (for clarity the chassis is not shown).

Using these components a chassis could provide 10-gigabit connectivity between the Internet and a private internal network. In the Figure, the Internet is connected to the FortiSwitch-5003B board in chassis slot 1 and the private internal network is connected to the FortiSwitch-5003B board in chassis slot 2. Traffic between these networks is switched across the chassis backplane to the FortiGate-5001B board for security processing.

Figure 3: Example 10-gigabit connection between a private internal network and the

Internet

FortiGate-5001B Board Installed in chassis slot 4

Fabric channel 1

10 Gigabit Data Communication

Slot 4

Slot 2

Fabric channel 2 10 Gigabit Data Communication

Internal 10-gigabit network connected to fabric channel 2

External 10-gigabit network connected

to fabric channel 1

Enhanced Load Balance Clustering (ELBC)

You can install one or two FortiSwitch-5003B boards and multiple FortiGate-5001B boards (called worker boards) in a FortiGate-5000 chassis to create an ELBC cluster. An ELBC cluster load balances network traffic across the worker boards in the cluster resulting in a network security solution that provides very high throughput. ELBC clusters are also scalable because you can add more worker boards to the cluster without disrupting network traffic. Also, if one of the FortiGate units in the cluster fails, the traffic it was processing is re-distributed to the other worker boards in the cluster, resulting in only minimal service interruption.

In an ELBC configuration the FortiSwitch-5003B board applies a load balancing algorithm against the source and/or destination address of received packets to generate a hash key. Each worker board has hash key values assigned to it and packets are forwarded to the worker blade assigned to the same hash key. If a worker board enters or leaves the cluster the hash keys are re-calculated and re-distributed so that all boards in the cluster receive a consistent amount of traffic.

Slot 1

FortiSwitch-5003B System Guide 01-400-134822-20120216 15

http://docs.fortinet.com/

Page 16

Enhanced Load Balance Clustering (ELBC) FortiSwitch-5003B system

Figure 4: Example ELBC configuration

Load Balancing over

10-gigabit Fabric

channel

External 10-gigabit

network

Router

FortiGate-5001B Boards

Router

Internal 10-gigabit

network

FortiSwitch-5003B

board

Slot 1 4 6 8

If you install a second FortiSwitch-5003B board you can configure active-passive ELBC HA. In an HA configuration, if the FortiSwitch-5003B board in slot 1 fails, all sessions are failed over to the FortiSwitch-5003B board in slot 2 with only a minimal traffic interruption. To be able to form a cluster, both of the FortiSwitch-5003B boards in an ELBC HA cluster must have part numbers of P11000-01 and up or both must have part numbers lower than P11000-01.

16 01-400-134822-20120216

FortiSwitch-5003B System Guide

http://docs.fortinet.com/

Page 17

FortiSwitch-5003B

Hardware installation

Before use, the FortiSwitch-5003B module must be correctly inserted into the first or second hub/switch slot of an Advanced Telecommunications Computing Architecture (ATCA) chassis such as the FortiGate-5140 or FortiGate-5060.

Before inserting the board into a chassis you should make sure the configuration switch is set correctly (current model).

This chapter describes:

• Installing SFP+ transceivers

• Changing FortiSwitch-5003B SW2 switch settings

• FortiSwitch-5003B mounting components

• Inserting a FortiSwitch-5003B board

• Shutting down and removing a FortiSwitch-5003B board

• Power cycling a FortiSwitch-5003B board

• Troubleshooting

Installing SFP+ transceivers

The FortiSwitch-5003B board ships with two SR SFP+ transceivers that you must install to connect the FortiSwitch-5003B front panel fabric or base channel interfaces to a network. The SFP transceivers are inserted into cage sockets numbered F1 to F8 for the fabric channel or B1 and B2 for the base channel on the FortiSwitch-5003B front panel. You can install the SFP transceivers before or after inserting the FortiSwitch-5003B board into a FortiGate-5000 series or other ATCA chassis.

You can install the following types of SFP transceivers for connectors F1 to F8:

• SFP+ SR

• SFP+ LR

To install SFP+ transceivers

To complete this procedure, you need:

• A FortiSwitch-5003B board

• Two or more SFP+ transceivers

• An electrostatic discharge (ESD) preventive wrist or ankle strap with connection cord

FortiSwitch-5003B boards must be protected from static discharge and physical shock. Only handle or work with FortiSwitch-5003B boards at a static-free workstation. Always wear a grounded electrostatic discharge (ESD) preventive wrist strap when handling FortiSwitch-5003B boards.

1 Attach the ESD wrist strap to your wrist and to an available ESD socket or wrist strap

terminal.

FortiSwitch-5003B System Guide 01-400-134822-20120216 17

http://docs.fortinet.com/

Page 18

Changing FortiSwitch-5003B SW2 switch settings Hardware installation

2 Remove the caps from SFP+ cage sockets on the FortiSwitch-5003B front panel.

Handling the SFP+ transceivers by holding the release latch can damage the connector. Do not force the SFP+ transceivers into the cage slots. If the transceiver does not easily slide in and click into place, it may not be aligned correctly. If this happens, remove the SFP+ transceiver, realign it and slide it in again.

3 Hold the sides of the SFP transceiver and slide SFP transceiver into the cage socket

until it clicks into place.

Changing FortiSwitch-5003B SW2 switch settings

You should only change the SW2 switch setting if are required to install the FortiSwitch-5003B board in a chassis that does not contain a functioning shelf manager. The default SW2 setting is required for most uses of the FortiSwitch-5003B including ELBCv3.

The SW2 switch on the FortiSwitch-5003B board is factory set by Fortinet to detect a shelf manager (Figure 5). This is the correct setting if you are installing the FortiSwitch-5003B board in a chassis that contains an operating shelf manager (such as a FortiGate-5000 series chassis).

The top of the FortiSwitch-5003B board is covered with a metal panel. The printed circuit board is under the metal panel. SW2 is located on the printed circuit board and is accessible through the small opening the metal panel as shown in Figure 5.

Figure 5: Location of SW2 on the FortiSwitch-5003B board

SW2

3421

FortiSwitch-5003B

SW2

Factory Default

3421

(Requires Shelf Manager)

SW2

Standalone Mode

3421

(No Shelf Manager)

Location of SW2

18 01-400-134822-20120216

Front Faceplate

FortiSwitch-5003B System Guide

http://docs.fortinet.com/

Page 19

Hardware installation Changing FortiSwitch-5003B SW2 switch settings

Figure 6: Factory default shelf manager mode setting for SW2

SW2

Factory Default

3421

(Requires Shelf

By default a FortiSwitch-5003B board will not start up if the board is installed in a chassis that does not contain a shelf manager or that contains a shelf manager that is not operating. Before installing a FortiSwitch-5003B in a chassis that does not contain an operating shelf manager you must change the SW2 switch setting to that shown in

Figure 7.

Figure 7: Standalone mode setting for SW2

SW2

Manager)

Standalone Mode

3421

(No Shelf Manager)

In all cases you should confirm that you have the correct SW2 setting before installing the board in a chassis.

Table 11: FortiSwitch-5003B SW2 settings

Correct

Chassis

SW2

Result of wrong jumper setting

Setting

SW2

Shelf manager cannot find FortiSwitch-5003B board. No shelf manager information about the

3421

FortiSwitch-5003B board available.

FortiSwitch-5003B board will not start up.

3421

FortiGate-5140B or 5060 or a ATCA chassis with a compatible operating shelf manager (factory default shelf manager mode).

Any ATCA chassis without an operating shelf manager (standalone mode).

If the shelf manager in a FortiGate-5000 series chassis is missing or not functioning, FortiSwitch-5003B boards with factory default SW2 settings will not start up.

To change or verify the SW2 switch setting

To complete this procedure, you need:

• A FortiSwitch-5003B board

• A tool for changing the SW2 switch setting (optional)

FortiSwitch-5003B System Guide 01-400-134822-20120216 19

http://docs.fortinet.com/

Page 20

FortiSwitch-5003B mounting components Hardware installation

• An electrostatic discharge (ESD) preventive wrist strap with connection cord

1 Attach the ESD wrist strap to your wrist and to an available ESD socket or wrist strap

terminal.

2 If you have installed the FortiSwitch-5003B board in a chassis, remove it.

For removal instructions, see “Shutting down and removing a FortiSwitch-5003B

board” on page 24.

3 Use Figure 5 on page 18 to locate SW2 on the FortiSwitch-5003B board.

4 If required, change SW2 to the correct setting.

5 Insert the FortiSwitch-5003B board into a chassis and verify that the board starts up

and operates correctly.

For inserting instructions, see “Inserting a FortiSwitch-5003B board” on page 21.

FortiSwitch-5003B mounting components

To install a FortiSwitch-5003B board you slide the board into a hub/switch slot in the front of an ATCA chassis (usually slot 1 or 2) and then use the mounting components to lock the board into place in the slot. When locked into place and positioned correctly the board front panel is flush with the chassis front panel. The board is also connected to the chassis backplane.

FortiSwitch-5003B boards are horizontal when inserted into a FortiGate-5050 chassis and vertical when inserted into a FortiGate-5140 chassis. The inserting and removing procedures are the same in either case. For clarity the descriptions in this document refer to the left (top) and right (bottom) mounting components.

To position the board correctly you must use the mounting components shown in

Figure 8 for the right (bottom) of the FortiSwitch-5003B front panel. The mounting

components on the left (top) of the front panel are the same but reversed. The FortiSwitch-5003B mounting components align the board in the chassis slot and are used to insert and eject the board from the slot.

20 01-400-134822-20120216

FortiSwitch-5003B System Guide

http://docs.fortinet.com/

Page 21

Hardware installation Inserting a FortiSwitch-5003B board

Figure 8: FortiSwitch-5003B right (bottom) mounting components

Closed

Alignment Pin

Retention

Screw

Handle

Lock

Handle

Alignment

Retention

Screw

Lock

Open

Alignment Pin

Alignment

Retention

Hook

Lock

Retention

Handle

Screw

Hook

Screw

Lock

The FortiSwitch-5003B handles (also called extraction levers) align the board in the chassis slot and are used to insert and eject the board from the slot. The right (bottom) handle activates a microswitch that turns on or turns off power to the board. When the right (bottom) handle is open the microswitch is off and the board cannot receive power. When the right (bottom) handle is fully closed the microswitch is on and if the board is fully inserted into a chassis slot the board can receive power.

You can use cycle the power and reset the board without removing the board from the chassis. See “Power cycling a FortiSwitch-5003B board” on page 26.

Inserting a FortiSwitch-5003B board

The FortiSwitch-5003B board must be fully installed in a chassis hub/switch slot (usually slot 1 or 2), with the handles closed and locked and retention screws fully tightened for the FortiSwitch-5003B board to receive power and operate normally. If the FortiSwitch-5003B board is not receiving power, the HS LED glows solid blue and all other LEDs remain off. See “Front panel components” on page 7.

It is important to carefully seat the FortiSwitch-5003B board all the way into the chassis, to not use too much force on the handles, and to make sure that the handles are properly locked. Only then will the FortiSwitch-5003B board power-on and start up correctly.

FortiSwitch-5003B boards are hot swappable. The procedure for inserting a FortiSwitch-5003B board into a chassis slot is the same whether or not the chassis is powered on.

FortiSwitch-5003B System Guide 01-400-134822-20120216 21

http://docs.fortinet.com/

Page 22

Inserting a FortiSwitch-5003B board Hardware installation

To insert a FortiSwitch-5003B board into a chassis slot

Do not carry the FortiSwitch-5003B board by holding the handles or retention screws. When inserting or removing the FortiSwitch-5003B board from a chassis slot, handle the board by the front panel. The handles are not designed for carrying the board. If the handles become bent or damaged the FortiSwitch-5003B board may not align correctly in the chassis slot.

To complete this procedure, you need:

• A FortiSwitch-5003B board

• An ATCA chassis with an empty hub/switch slot

• An electrostatic discharge (ESD) preventive wrist strap with connection cord

1 Attach the ESD wrist strap to your wrist and to an ESD socket or to a bare metal

surface on the chassis or frame.

2 If required, remove the protective metal frame that the FortiSwitch-5003B board has

been shipped in.

3 Insert the FortiSwitch-5003B board into the empty hub/switch slot in the chassis.

4 Unlock the handles by squeezing the handle locks.

Unlock

Handle

5 Open the handles to their fully open positions.

To avoid damaging the lock, make sure you squeeze the handles fully to unlock them before opening. The handles should pop easily out of the board front panel.

Alignment Pin

Handle

Open

22 01-400-134822-20120216

Handle

Lock

FortiSwitch-5003B System Guide

http://docs.fortinet.com/

Page 23

Hardware installation Inserting a FortiSwitch-5003B board

6 Carefully guide the board into the chassis using the rails in the slot.

Insert the board by applying moderate force to the front faceplate (not the handles) to slide the board into the slot. The board should glide smoothly into the chassis slot. If you encounter any resistance while sliding the board in, the board could be aligned incorrectly. Pull the board back out and try inserting it again.

7 Slide the board in until the alignment pins are inserted half way into their sockets in

the chassis.

8 Turn both handles to their fully-closed positions.

The handles should hook into the sides of the chassis slot. Closing the handles draws the FortiSwitch-5003B board into place in the chassis slot and into full contact with the chassis backplane. The FortiSwitch-5003B front panel should be in contact with the chassis front panel. When the handles are fully-closed they lock into place.

As the right (bottom) handle closes the microswitch is turned on, supplying power to the board. If the chassis is powered on the HS LED starts flashing blue. If the board is aligned correctly, inserted all the way into the slot, and the right (bottom) handle is properly closed the HS LED flashes blue for a few seconds. At the same time the ACT and HTY LEDs turn green. After a few seconds the HS LED goes out and the FortiSwitch-5003B firmware starts up. If the board is operating correctly, the front panel LEDs are lit as described in Table 12.

Table 12: FortiSwitch-5003B normal operating LEDs

LED State

OOS Off

Power Green

Status Off

ACC

Off (Or flashing green when the system accesses the FortiSwitch-5003B flash disk.)

IPM Off

If the board has not been inserted properly the HS LED changes to solid blue and all other LEDS turn off. If this occurs, open the handles, slide the board part way out, and repeat the insertion process.

9 Once the board is inserted correctly, fully tighten the retention screws to lock the

FortiSwitch-5003B board into position in the chassis slot.

Retention

Screw

Tighten

FortiSwitch-5003B System Guide 01-400-134822-20120216 23

http://docs.fortinet.com/

Page 24

Shutting down and removing a FortiSwitch-5003B board Hardware installation

Shutting down and removing a FortiSwitch-5003B board

To avoid potential hardware problems, always shut down the FortiSwitch-5003B operating system properly before removing the FortiSwitch-5003B board from a chassis slot or before powering down the chassis.

The following procedure describes how to correctly use the FortiSwitch-5003B mounting components described in “FortiSwitch-5003B mounting components” on page 20 to remove a FortiSwitch-5003B board from an ATCA chassis slot.

FortiSwitch-5003B boards are hot swappable. The procedure for removing a FortiSwitch-5003B board from a chassis slot is the same whether or not the chassis is powered on.

To remove a FortiSwitch-5003B board from a chassis slot

To complete this procedure, you need:

• An ATCA chassis with a FortiSwitch-5003B board installed

• An electrostatic discharge (ESD) preventive wrist strap with connection cord

1 Attach the ESD wrist strap to your wrist and to an ESD socket or to a bare metal

surface on the chassis or frame.

2 Disconnect all cables from the FortiSwitch-5003B board, including all network cables

and the console cable.

3 Fully loosen the FortiSwitch-5003B retention screws.

Retention

Screw

Loosen

4 Unlock the handles by squeezing the handle locks.

5 Slowly open both handles a small amount (about 8 degrees) until the IPM LED flashes

blue.

24 01-400-134822-20120216

FortiSwitch-5003B System Guide

http://docs.fortinet.com/

Page 25

Hardware installation Shutting down and removing a FortiSwitch-5003B board

6 Keep the handles in this position until the IPM LED stops flashing and becomes solid

blue.

Waiting for the IPM LED to change to solid blue makes sure that the board software shutdowns completely before disconnecting it from backplane power.

7 Open the handles to their fully open positions.

To avoid damaging the lock, make sure you squeeze the handles fully to unlock them before opening. The handles should pop easily out of the board front panel.

Opening the handles turns off the microswitch, turns off all LEDs, and ejects the board from the chassis slot. You need to use moderate pressure on the handles to eject the board.

Alignment Pin

Handle

Open

Handle

Lock

8 Pull the board about half way out.

9 Turn both handles to their fully-closed positions.

When the handles are fully-closed they lock into place.

Alignment Pin

Handle

Fully Closed

and Locked

Handle

10 Carefully slide the board completely out of the slot.

11 Re-attach the protective metal frame if you are going ship the FortiSwitch-5003B

board or store it outside of a chassis.

FortiSwitch-5003B System Guide 01-400-134822-20120216 25

http://docs.fortinet.com/

Page 26

Power cycling a FortiSwitch-5003B board Hardware installation

Power cycling a FortiSwitch-5003B board

This section describes how to cycle the power on a FortiSwitch-5003B board by opening the right handle (the lower handle when the board is installed vertically in a FortiGate-5140 chassis) to activate a switch that cycles the power without removing the board from the chassis. The steps recommend loosening the retention screws before opening the handle to allow the handle to toggle the switch. During this process the board may move out a small amount (less than 1 mm).

To avoid potential hardware problems, always shut down the FortiSwitch-5003B operating system properly before power cycling the FortiSwitch-5003B board.

To power cycle a FortiSwitch-5003B board without fully removing the board from the chassis

To complete this procedure, you need:

• An ATCA chassis with a FortiSwitch-5003B board installed

• An electrostatic discharge (ESD) preventive wrist strap with connection cord

1 Shut down the operating system running on the FortiSwitch-5003B board. For

example:

• From the web-based manager, go to the Unit Operation dashboard widget, select Shutdown and then select OK.

• From the CLI enter

execute shutdown

2 Attach the ESD wrist strap to your wrist and to an available ESD socket or wrist strap

terminal.

3 Fully loosen the retention screws on the FortiSwitch-5003B front panel.

4 Unlock both handles by squeezing the handle locks.

Unlock

Handle

5 Slowly open both handles a small amount (about 8 degrees) until the IPM LED flashes

blue.

6 Keep the handles in this position until the IPM LED stops flashing and becomes solid

blue.

7 After 10 seconds snap both handles back into place.

The board powers up, the LEDs light and in a few minutes the FortiSwitch-5003B board operates normally.

26 01-400-134822-20120216

FortiSwitch-5003B System Guide

http://docs.fortinet.com/

Page 27

Hardware installation Troubleshooting

8 Fully tighten the retention screws to lock the FortiSwitch-5003B board into position in

the chassis slot.

Troubleshooting

This section describes the following troubleshooting topics:

• FortiSwitch-5003B does not startup

FortiSwitch-5003B does not startup

Positioning of FortiSwitch-5003B handles and a few other causes may prevent a FortiSwitch-5003B board for starting up correctly.

All chassis: handles not fully closed

If the handles are damaged or positioned incorrectly the FortiSwitch-5003B board will not start up. Make sure the handles are correctly aligned, fully inserted and locked.

All chassis: Firmware problem

If the FortiSwitch-5003B board is receiving power and the handles are fully closed, and you have restarted the chassis and the FortiSwitch-5003B still does not start up, the problem could be with FortiOS. Connect to the FortiSwitch-5003B console and try cycling the power to the board. If the BIOS starts up, interrupt the BIOS startup and install a new firmware image.

If this does not solve the problem, contact Fortinet Technical Support.

FortiSwitch-5003B status LED is flashing during system operation

Normally, the FortiSwitch-5003B Status LED is off when the FortiSwitch-5003B board is operating normally. If this LED starts flashing while the board is operating, a fault condition may exist. At the same time the FortiSwitch-5003B may stop processing traffic.

To resolve the problem you can try removing and reinserting the FortiSwitch-5003B board in the chassis slot. Reloading the firmware may also help.

If this does not solve the problem there may have been a hardware failure or other problem. Contact Fortinet Technical Support for assistance.

FortiSwitch-5003B System Guide 01-400-134822-20120216 27

http://docs.fortinet.com/

Page 28

Troubleshooting Hardware installation

28 01-400-134822-20120216

FortiSwitch-5003B System Guide

http://docs.fortinet.com/

Page 29

FortiSwitch-5003B

Quick Configuration Guide

This section is a quick start guide to connecting and configuring a FortiSwitch-5003B board.

Before using this chapter, your FortiGate-5000 series or compatible ATCA chassis should be mounted and connected to your power system. In addition, your FortiSwitch-5003B board should be inserted into the chassis. The FortiSwitch-5003B board should also be powered up and the front panel LEDs should indicate that the boards are functioning normally.

This chapter includes the following topics:

• Registering your Fortinet product

• Factory default settings

• Basic configuration

• Upgrading FortiSwitch-5000 series firmware

• Additional configuration

Registering your Fortinet product

Register your Fortinet product to receive Fortinet customer services such as product updates and customer support. You must also register your product for FortiGuard services such as FortiGuard Antivirus and Intrusion Prevention updates and for FortiGuard Web Filtering and AntiSpam.

To register, enter your contact information and the serial numbers of the Fortinet products that you or your organization have purchased. You can register multiple Fortinet products in a single session without re-entering your contact information.

Factory default settings

The FortiSwitch-5003B unit ships with a factory default configuration. The default configuration allows you to connect to and use the FortiSwitch-5003B CLI to configure the FortiSwitch-5003B board. To configure the FortiSwitch-5003B board you add an administrator password, change the management interface IP address, and, if required, configure the default route for the management interface.

Table 13: FortiSwitch-5003B factory default settings

Administrator Account

MGMT IP/Netmask 192.168.1.99/24

Default route

User Name: admin

Password: (none)

Gateway: 192.168.1.254

Device: mgmt

FortiSwitch-5003B System Guide 01-400-134822-20120216 29

http://docs.fortinet.com/

Page 30

Basic configuration Quick Configuration Guide

At any time during the configuration process, if you run into problems, you can reset the FortiSwitch-5003B board to the factory defaults and start over. From the CLI enter execute factory-reset.

Basic configuration

Use the information in this section to configuration basic configuration settings that connect the FortiSwitch-5003B board to your network.

Web-based Manager

1 Connect the FortiSwitch-5003B MGMT interface to a management computer Ethernet

interface.

2 Configure the management computer to be on the same subnet as the MGMT

interface. To do this, change the IP address of the management computer to

192.168.1.2 and the netmask to 255.255.255.0.

3 To access the FortiSwitch-5003B web-based manager, start a web browser and type

the address https://192.168.1.99

4 Type admin in the Name field and select Login.

To change the administrator password

1 Go to the Administrators dashboard widget.

2 Edit the admin administrator, select Change Password and enter and confirm a new

password.

To change the management IP address and administrative access

1 Go to the Management Port dashboard widget.

2 Select Change.

3 Enter a new IP address and netmask for the MGMT interface.

4 Change administrative access as required.

5 Select OK.

If you change the MGMT interface IP address you need to browse to this new IP address to reconnect to the web-based manager.

To configure base channel interfaces

1 Go to Switch > Base Channel > Port and configure physical port settings such as

adding a description of the interface or bringing the interface up or down and configure static trunking.

2 Go to Switch > Base Channel > Interface to configure the base channel interface’s

native VLAN and allowed VLANs.

To configure fabric channel interfaces

1 Go to Switch > Fabric Channel > Port to add a description of the interface or bring the

interface up or down. For interfaces that support it you can change the interface speed and configure static trunking, LACP(802.3ad) trunking or Forti-trunking.

2 Go to Switch > Fabric Channel > Interface to change the interface’s native VLAN and

allowed VLANs, and enable or disable the spanning tree protocol (STP) on the interface.

30 01-400-134822-20120216

FortiSwitch-5003B System Guide

http://docs.fortinet.com/

Page 31

Quick Configuration Guide Basic configuration

3 Go to Switch > Fabric Channel > STP Settings to change some STP parameters for

the FortiSwitch-5003B board.

4 Go to Switch > Fabric Channel > STP Instance to add, edit, or delete STP instances.

CLI

1 Use the serial cable supplied with your FortiSwitch-5003B board to connect the front

panel RJ-45 CONSOLE port to the management computer serial port.

You can also connect to the CLI using an SSH connection to the MGMT interface. The default IP address is 192.168.1.99/24.

2 Start a terminal emulation program (HyperTerminal) on the management computer.

Use these settings:

Baud Rate (bps) 9600

Data bits 8

Parity None

Stop bits 1

Flow Control None

3 At the Login: prompt, type admin and press Enter twice (no password required).

4 Change the administrator password.

config admin user

edit admin

set password <password>

end

5 Configure the mgmt interface.

config system interface

edit mgmt

set ip <ip_address>/<netmask>

end

If you have connected to the FortiSwitch-5003B CLI using telnet or SSH, since this step changes the mgmt interface IP address you will have to re-establish the Telnet or SSH session.

6 Configure the default gateway for the management interface.

config route static

edit 1

set gateway <gateway_ip>

end

FortiSwitch-5003B System Guide 01-400-134822-20120216 31

http://docs.fortinet.com/

Page 32

Upgrading FortiSwitch-5000 series firmware Quick Configuration Guide

7 To configure base channel interface physical port settings, enter:

config switch base-channel physical-port

edit slot-3

set status up

end

8 To configure base channel interface native VLANs, enter:

config switch base-channel interface

edit slot-5

set native-vlan 23

end

9 To configure fabric channel interface physical port settings, enter:

config switch fabric-channel physical-port

edit slot-3

set status up

end

10 To configure base channel interface native VLANs, enter:

config switch fabric-channel interface

edit slot-5

set native-vlan 23

end

Upgrading FortiSwitch-5000 series firmware

Fortinet periodically updates the FortiSwitch-5003B FortiOS firmware to include enhancements and address issues. After you have registered your FortiSwitch-5003B security system (see “Registering your Fortinet product” on page 29) you can download FortiSwitch-5003B firmware from the support web site http://support.fortinet.com.

To upgrade the firmware from the web-based manager

1 Go to System > Status > Dashboard > System Information.

2 Select Update beside Firmware Version.

To upgrade the firmware from the CLI

To use the following procedure, you must have a TFTP server the FortiSwitch-5003B board can connect to.

1 Make sure the TFTP server is running.

2 Copy the new firmware image file to the root directory of the TFTP server.

3 Log into the FortiSwitch-5003B CLI.

4 Make sure the FortiGate board can connect to the TFTP server.

You can use the following command to ping the computer running the TFTP server. For example, if the IP address of the TFTP server is 192.168.1.168:

execute ping 192.168.1.168

32 01-400-134822-20120216

FortiSwitch-5003B System Guide

http://docs.fortinet.com/

Page 33

Quick Configuration Guide Additional configuration

5 Enter the following command to copy the firmware image from the TFTP server to the

FortiSwitch-5003B board:

execute restore image tftp <name_str> <tftp_ipv4>

Where <name_str> is the name of the firmware image file and <tftp_ipv4> is the IP address of the TFTP server. For example, if the firmware image file name is image.out and the IP address of the TFTP server is 192.168.1.168, enter:

execute restore image tftp image.out 192.168.1.168

The FortiSwitch-5003B board responds with message similar to the following:

This operation will replace the current firmware version and reboot the system Do you want to continue? (y/n)

6 Type y.

The FortiSwitch-5003B board uploads the firmware image file, upgrades to the new firmware version, and restarts. This process takes a few minutes.

7 Reconnect to the CLI.

8 To confirm the firmware image is successfully installed, enter:

get system status

Additional configuration

The following additional configuration settings are available:

• Disabling the front panel F8 interface and enabling the fabric backplane interconnect

(slot-1/2)

• Disabling the front panel F8 interface and enabling the slot-14 fabric interface

• Changing the system time and host name

• Changing the switch fabric-channel configuration

Disabling the front panel F8 interface and enabling the fabric backplane interconnect (slot-1/2)

Because of the number of available ports in the FortiSwitch-5003B switch hardware, front panel interface F8 and fabric backplane interconnection between channel 1 and channel 2 (slot-1/2), share the same FortiSwitch-5003B port. By default, the active connection is set to front panel interface F8. You can change this setting using the following CLI command:

config switch fabric-channel physical-port

edit f8/slot-1/2

set active-connection slot-1/2

end

The FortiSwitch-5003B board responds with a confirmation message. Accept the change and the FortiSwitch-5003B board reboots.

Disabling the front panel F8 interface and enabling the slot-14 fabric interface

On older FortiSwitch-5003B boards with part numbers lower than P11000-01, the front panel interface F8 and the slot-14 fabric backplane interface share the same switch port. By default, the active connection was set to front panel interface F8. You can change this setting using the following CLI command:

config switch fabric-channel physical-port

FortiSwitch-5003B System Guide 01-400-134822-20120216 33

http://docs.fortinet.com/

Page 34

Additional configuration Quick Configuration Guide

edit f8/slot-14

set active-connection slot-14

end

The FortiSwitch-5003B board responds with a confirmation message. Accept the change and the FortiSwitch-5003B board reboots.

Changing the system time and host name

You can use the FortiSwitch-5003B CLI to configure other basic system settings such as using config system global to set system time settings and change the system host name. Execute commands are also available for setting the system time and date and backing up the configuration.

Changing the switch fabric-channel configuration

If you are using the FortiSwitch-5003B system for link aggregation or just to pass VLANs you need to use the config switch fabric-channel command. This command has several options that can be used to:

• Change global switch settings.

• Add VLANs to and changes the native VLANs of the FortiSwitch-5003B interfaces.

• Configure packet mirroring.

• Configure physical port settings for each fabric port.

• Configure MTSP.

• Aggregate FortiSwitch-5003B fabric interfaces into trunks.

34 01-400-134822-20120216

FortiSwitch-5003B System Guide

http://docs.fortinet.com/

Page 35

FortiSwitch-5003B

For more information

Training Services

Fortinet Training Services offers courses that orient you quickly to your new equipment, and certifications to verify your knowledge level. Fortinet training programs serve the needs of Fortinet customers and partners world-wide.

Visit Fortinet Training Services at http://campus.training.fortinet.com, or email

training@fortinet.com.

Technical Documentation

Visit the Fortinet Technical Documentation web site, http://docs.fortinet.com, for the most up-to-date technical documentation.

The Fortinet Knowledge Base provides troubleshooting, how-to articles, examples, FAQs, technical notes, and more. Visit the Fortinet Knowledge Base at

http://kb.fortinet.com.

Comments on Fortinet technical documentation

Send information about any errors or omissions in this or any Fortinet technical document to techdoc@fortinet.com.

Customer service and support

Fortinet is committed to your complete satisfaction. Through our regional Technical Assistance Centers and partners worldwide, Fortinet provides remedial support during the operation phase of your Fortinet product's development life cycle. Our Certified Support Partners provide first level technical assistance to Fortinet customers, while the regional TACs solve complex technical issues that our partners are unable to resolve.

Visit Customer Service and Support at http://support.fortinet.com.

Fortinet products End User License Agreement

See the Fortinet products End User License Agreement.

FortiSwitch-5003B System Guide 01-400-134822-20120216 35

http://docs.fortinet.com/

Page 36

Fortinet products End User License Agreement For more information

February 16, 2012

01-400-134822-20120216

Copyright© 2012 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, and FortiGuard®, are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance metrics contained herein were attained in internal lab tests under ideal conditions, and performance may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to the performance metrics herein. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. Fortinet disclaims in full any guarantees. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.

Visit these links for more information and documentation for your Fortinet products:

Fortinet Knowledge Base - http://kb.fortinet.com

Technical Documentation - http://docs.fortinet.com

Training Services - http://campus.training.fortinet.com

Customer Service and Support - http://support.fortinet.com

You can report errors or omissions in this or any Fortinet technical document to

techdoc@fortinet.com.

36 01-400-134822-20120216

FortiSwitch-5003B System Guide

http://docs.fortinet.com/