Configuring LLDP for Cisco IP Phones on Stand Alone FortiSwitch

By Manny Fernandez

December 3, 2018

Configuring LLDP for Cisco IP Phones on Stand Alone FortiSwitch

As you may or may not know, Fortinet makes switches and they are doing very well from a saturation perspective. Customers are enamored with the pricing of course, but also the ease of use and the super tight integration for those customers using the Fortigate firewall. With the Fortigate, you can manage the switches right from the Fortigate GUI.

However, if you are familiar with the Cisco world of switching, you know that CDP is enabled by default. CDP or Cisco Discovery Protocol (Depending on who you speak to becuse it is rumorred that it was CABLETRON Discovery Protocol, but I digress) allows the Cisco IP Phones to automatically be moved to a ‘voice’ VLAN of your choosing. Since Forinet is obviously NOT Cisco, they have opted for the Stanadards Based (IEEE 802.1AB) LLDP (Link Layer Discovery Protocol).

This was my setup:

FortiSwitch connected to a Cisco Switch running DHCP

ip dhcp pool Data
network 10.2.100.0 /24
default-router 10.2.100.1
ip dhcp excluded-address 10.2.100.1 10.2.100.5

ip dhcp pool Voice
network 10.2.101.0 /24
default-router 10.2.101.1
ip dhcp excluded-address 10.2.101.1 10.2.101.5

Cisco switch was configured to allow VLANs 100-101 on an 802.1q port (Fa0/48). On the FortiSwitch, we configured port 5 as an 802.1q trunk allowing VLANs 100-101.

edit "port5"
set native-vlan 1
set allowed-vlans 100-101
unset untagged-vlans
set discard-mode none
set dhcp-snooping untrusted
set dhcp-snoop-learning-limit-check disable
set dhcp-snoop-option82-trust disable
set stp-state enabled
set stp-loop-protection disabled
set stp-root-guard disabled
set stp-bpdu-guard disabled
set loop-guard disabled
set edge-port enabled
set auto-discovery-fortilink disable
set auto-discovery-fortilink-packet-interval 5
set snmp-index 5
config port-security
set framevid-apply enable
set port-security-mode none
end
set learning-limit 0
set sticky-mac disable
next

You can see the ‘allowed VLAN’ command shows VLAN 100-101

To configure the LLDP profile, change the ’set vlan 101’ to the corresponding voice VLAN in your environment.

config switch lldp profile
edit "default"
set med-tlvs inventory-management network-policy
set 802.1-tlvs port-vlan-id
set auto-isl disable
config med-network-policy
edit "voice"
set status enable
set status enable
set vlan 101
set dscp 46
end

Once the LLDP configuration is configured, you can now configure the port(s).

edit "port2"
set native-vlan 100
set allowed-vlans 100-101
unset untagged-vlans
set discard-mode none
set dhcp-snooping untrusted
set dhcp-snoop-learning-limit-check disable
set dhcp-snoop-option82-trust disable
set stp-state enabled
set stp-loop-protection disabled
set stp-root-guard disabled
set stp-bpdu-guard disabled
set loop-guard disabled
set edge-port enabled
set auto-discovery-fortilink disable
set auto-discovery-fortilink-packet-interval 5
set snmp-index 2
config port-security
set framevid-apply enable
set port-security-mode none
end
set learning-limit 0
set sticky-mac disable
next

The screeenshot shows the GUI version of the configuration.

Once you attach the Cisco phone and it powers up, you can see on the DHCP binding table that I have one IP address on VLAN 100 and one on VLAN 101.

The MAC address with the 10.2.100.7 is a MacBook Pro while the 10.2.101.6 is the Cisco phone. Of course the date is wrong because I nuked the config on the Cisco switch 🙂

On the FortiSwitch, you can go to the ‘Monitor’ tab under the ‘Switch’ section and click on the LLDP section.

On a Fortigate managed FortiSwitch, the commands are similar:

config switch lldp-profile
edit "default"
set med-tlvs inventory-management network-policy
set 802.1-tlvs port-vlan-id
set auto-isl disable
config med-network-policy
edit "voice"
set status enable
set vlan 101
set dscp 46
!
!
edit "port2"
set poe-capable 1
set vlan "DATA"
set allowed-vlans "qtn.fortilink" "VOIP"
set untagged-vlans "qtn.fortilink"
set lldp-profile "default"
set export-to "root"
set description "Cisco Phone"
next

In this scenario, the VLAN on the Fortigate is VOIP and DATA respectviely. Some command change slightly but they function the same.

Configuring LLDP for Cisco IP Phones on Stand Alone FortiSwitch

Recent posts