Skip to main content
TheChosenOne
TheChosenOne
New Member
April 11, 2022
Solved

Connect two HA Clusters in a redundant way

  • April 11, 2022
  • 4 replies
  • 5537 views

Hi Community,

I have two HA Clusters that I need to connect.

DC1 has 2x FG200E running active-acative
DC2 has 2x FG201F running active-passive

How would you connect those two HA clusters? I want to be able to lose one of the Forigates on each side.

Would you put a switch in between and connect to the switch using an aggregate?
Or would you directly connect the Fortigates?

I want to create a /30 transfer network to route traffic between the two DCs.

Thanks for your suggestions. :)

Best answer by AlexC-FTNT

For a simple connection between them you definitely need a switch to handle it, especially if you plan to use an aggregate link.
Cluster1 has units 1A (1Aport1,1Aport2) - LACP1A, 1B(1Bport1,1Bport2) - LACP1B on switch

This is on the local switch. Which can further linked with an aggregate to the remote local switch:

Cluster2 has units 2A (2Aport1,2Aport2) - LACP2A, 2B(2Bport1,2Bport2) - LACP2B on switch

4 replies

AlexC-FTNT
Staff
AlexC-FTNT
Staff
April 12, 2022

The main question is "why do you need to connect them"?

What is the goal you are trying to achieve?

 

If the goal is redundancy, you can set them up in FGSP, but the topology must be fairly symmetrical:

https://docs.fortinet.com/document/fortigate/6.0.0/handbook/284323/fortigate-session-life-support-protocol-fgsp

Connecting them through a switch/directly connecting them will not provide any redundancy, as the two clusters will "fight" for the Master role-  you will either have packet/session drops or a lot of retransmissions, as each cluster will forward the traffic and try to establish sessions for the clients.

TheChosenOne
TheChosenOneAuthor
New Member
April 12, 2022

Hi Alex,

it's not for HA redundancy. Im happy with the two seperate HA clusters.

I just have these two Datacenters and want a direct connection between them for internal traffic from one DC to the other. The Connection between the Datacenters should be established in a way that allows any of the cluster units to fail without interrupting the connection between the Datacenters.

As mentioned, my plan is to create a /30 Subnet as transfer Network where both clusters have an interface in this subnet so Traffic between the Datacenters can be routed.

My question is, what is the most elegant way to connect the two sites. Directly (if yes, how) or with a switch in between.

Thanks!

AlexC-FTNT
Staff
AlexC-FTNTAnswer
Staff
April 12, 2022

For a simple connection between them you definitely need a switch to handle it, especially if you plan to use an aggregate link.
Cluster1 has units 1A (1Aport1,1Aport2) - LACP1A, 1B(1Bport1,1Bport2) - LACP1B on switch

This is on the local switch. Which can further linked with an aggregate to the remote local switch:

Cluster2 has units 2A (2Aport1,2Aport2) - LACP2A, 2B(2Bport1,2Bport2) - LACP2B on switch

TheChosenOne
TheChosenOneAuthor
New Member
April 12, 2022

Thanks Alex!

That's the setup I already tried out in my sandbox. I was hoping there could be a solution without switches. Anyway, thanks for your time and help.

Cheers

    AlexC-FTNT
    Staff
    AlexC-FTNT
    Staff
    April 12, 2022

    As long as you have HA, there must be (at least) a switch for redundancy and to connect the ISP link(s) to both units. And these switches are already present on site (while LACPs only provide an increase in bandwidth)

    Terms & ConditionsAccessibility statement