Skip to main content
jroy777
jroy777
Explorer II
September 16, 2024
Question

Can we do VRRP/BGP and redundant wan paths? Can it be active/active or only active/passive?

  • September 16, 2024
  • 3 replies
  • 1666 views

We have existing Fortiswitch that is connected to a Cisco ASR. The Cisco has the layer 3 interfaces and IP's assigned for WAN and vlan subnets. We want to now install a second FortiSwitch, use the layer3 capabilities and use vrrp to make the link redundant (will convert existing Fortiswitch after configuration for new Fortiswitch is working). We have installed a 2nd circuit and will configure it to this second Fortiswitch that will now handle layer 3.

In essence, we want the Fortiswitches to be redundant on the LAN side to handle Vlan's (is that MCLAG?) but also be redundant  but have a unique path out layer 3 to AWS. Each Fortiswitch has a separate layer 3 Circuit to AWS and I want to know if this can be Active/Active to use both circuits or only active/passive. The internet side is 10G for both circuits.

Please let me know if this makes sense. Can anyone share a similar config?

RedundantRedundant


3 replies

honelbo1
honelbo1
New Member
September 17, 2024

It is most likely not a VRRP issue. Your active router responds to ARP requests for the gateway, and all the outgoing traffic is going to that router. Now when traffic moves through the ISP core and the internet, it is perfectly possible for the return traffic to be routed to your passive VRRP router. Maybe because for some reason the routing protocol (BGP) finds the route to your passive router more attractive. A failure on the primary link, or like your ISP said, a backbone problem in the core can be the source of that https://vidmate.bid/ .

    jroy777
    jroy777Author
    Explorer II
    September 17, 2024

    Thanks for the response. I have an issue at the moment that won't even let me get to the vrrp portion. I am unable to establish the layer 3 BGP connectivity on the FortiSwitch back to AWS. I had this same issue with the 1st FS and ended up installing a Cisco ASR in front to route layer 3 and get the BGP to work. How do i create an interface that can actually pass traffic at layer 3 on the FS? What am I missing?

    config switch physical-port
    edit "port28"
    set description "Uplink to Megaport AWS-DC Circuit #2"
    set lldp-profile "default-auto-isl"
    set speed 10000full
    edit "port28"
    set native-vlan 364
    set snmp-index 28
    next

    config router static
    edit 1
    set dst 0.0.0.0 0.0.0.0
    set gateway 169.254.96.33
    next

    config router bgp
    set as 64516
    set router-id 169.254.96.38
    config neighbor
    edit "169.254.96.33"
    set remote-as 64513
    next
    end

    Terms & ConditionsAccessibility statement