Skip to main content
sonydarrel
sonydarrel
New Member
July 7, 2015
Question

Active Active Firewall 1200D

  • July 7, 2015
  • 3 replies
  • 4816 views

Dears

 

This is my new installation of 1200D i have a Cisco Nexus acting as a core for the campus which are connecting to the 1200D, my question is my both Nexus core are active (forwarding traffic) i also want my 2* 1200D firewall to be in active active state as it is not configured for any VDOM is it possible ???  i am having a cisco asa firewall knowledge where an asa can be active active only in multiple context mode, it means for context A--- FW-A is active and FW-B is standby for context B ----FW-B is active and FW-A is in standby.

    3 replies

    gschmitt
    gschmitt
    New Member
    July 7, 2015

    sonydarrel wrote:

    This is my new installation of 1200D i have a Cisco Nexus acting as a core for the campus which are connecting to the 1200D, my question is my both Nexus core are active (forwarding traffic) i also want my 2* 1200D firewall to be in active active state as it is not configured for any VDOM is it possible ???

    Could you describe the setup a bit more?

     

    If I understand you correctly you want an Active-Active HA Cluster. This is doable. Simply select "Active-Active" in the HA Config Menu instead of Active-Passive

    emnoc
    emnoc
    New Member
    July 7, 2015

    Are you running multi-vdoms? with virtual-clustering you can run multiple vdoms on each  fortigate in the same fashion as the cisco multi-contexts & load-balane vdoms.

     

    or

     

    If you want to run pure A-A and loadblance sessions be aware of the limits and what can or pretty much not load-balance. Here the Active ( master ) unit controls pretty much all sessions allocations  based on lb or weighted by assignment of the virtual-mac. If your familiar with cisco GLBP, than you will understand the fortigate A-A concept.

     

     

    sonydarrel
    sonydarrelAuthor
    New Member
    July 8, 2015

    Dear,

     

    I am not running any VDOMS still i can configure the 2 * fortinet as A-A,  this is not possible in Cisco, as per gschmitt reply it is it is doable just by choosing A-A in the HA config, so this mean both the firewall can forward traffic though they are in no multiple VDOMS

     

    Please confirm my thoughts.

    thanks

    storn
    storn
    New Member
    July 13, 2015

    Hi,

     

    you can run Active-Active with only one VDOM. This is referred to as "UTM Offloading" where the primary unit offloads UTM-enabled sessions to the subordinate unit(s) (Units, because fortigate clusters can grow up to 4 units).

     

    You can enable the cluster to also offload TCP and UDP sessions (without UTM enabled), but this is not recommended since all sessions will be first handled by the primary unit, only heavy UTM session offloading can result in higher throughput.

     

    Note that is is not load-balancing, but rather load-sharing what you're about to accomplish. Active-Active in the Cisco mind is called Virtual Clustering on FortiGate.

     

    Regards,

     

    Steffen

    Terms & ConditionsAccessibility statement