Skip to main content
Network-Eng2022
Network-Eng2022
New Member
April 25, 2023
Question

Connecting HA Cluster Firewalls to another HA Cluster Firewalls

  • April 25, 2023
  • 3 replies
  • 4840 views

I have an 2 seperate HA Active-Passive Cluster of Fortigate Firewalls.

I want to connect the first cluster to other cluster without introducing any switches in between in a full mesh connectivity. This is required to achieve full redundancy between the 2 HA clusters.

What is the best practice in achieving the above? Is creating Redundancy Interface and add 2 10GB port to this interface on both will do the job?

 

3 replies

srajeswaran
Staff
srajeswaran
Staff
April 25, 2023

Please check if FGSP clustering between the current clusters is the solution for you.

 

https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/668583/fgsp

 

 

    Network-Eng2022
    Network-Eng2022Author
    New Member
    April 25, 2023

    I have checked the document shared.

    Actually what I am trying to achieve is connect 1 HA Cluster (Active-Passive) (Site-A) to another HA Cluster (Active-Passive)(Site-B) through direct fiber cables in a full mesh.

    srajeswaran
    Staff
    srajeswaran
    Staff
    April 25, 2023

    Can you confirm how is the traffic flow through these 2 clusters? A full mesh HA is to avoid a single point of failure in network, something like below.

     

    Full-Mesh-HA.png

     In your setup, you have 2 HA, are they redundant to each other? If so, how is the sessions synced between them and how is the traffic flow.

      gfleming
      Staff
      gfleming
      Staff
      April 26, 2023

      Is there a reason you don't want to use switches in between? 

        CEMS
        CEMS
        New Member
        May 10, 2024

        Hi,Do you have a solution for that issue,I live same problem?

        AEK
        SuperUser
        AEK
        SuperUser
        May 10, 2024

        Hi CEMS

        Didn't test it and don't know if it is supported, but I think you can do it with a hardware (or software) switch interface.

        i.e.: one each cluster you configure 2 ports as hardware (or software) switch, then you inter connect the two clusters via these ports, like shown below.

        ha_inter.png

        AEK
        CEMS
        CEMS
        New Member
        May 10, 2024

        Many thanks AEK,Ye I can Hardware or Software Switch,actually I can Redundancy or 802.3 ag but  I use HA Active(tus11,art11) and Passive (tus12,art12) How can trigger  something happens ,in my scenario connection 1 from tus11emc to art11 is down How can I transfer traffic through to art12 emc ,I could not add software or hardware swtich interface ha monitor interface by the way ,I just add redundant or 802.3AG interface,should I configure wtih these interface or should I do ip sla 

        Adsız-2024-05-10-1137.png

        Terms & ConditionsAccessibility statement