FortiGate 901G HA Cluster with Cisco Switch Stack Using LACP – Best Practice Configuration

Question

I am looking for a best-practice and supported configuration for setting up two FortiGate 901G devices in an HA cluster and connecting them to a Cisco switch stack/cluster using LACP.Environment Details:FortiGate model: 901G (2 units)HA mode: Not decided yet (Active-Passive or Active-Active)Switching environment: Cisco switch stack / clustered switchesLink aggregation: LACP (802.3ad)Objective:High availability at the firewall levelRedundant and aggregated uplinks to the Cisco switch stackStable and supported HA + LACP designAvoid split-brain, MAC flapping, or failover issuesQuestions:What is the recommended Fortinet-supported topology for FortiGate 901G HA when using LACP to Cisco switch stacks?Should LACP be configured using a FortiGate aggregate interface, and should it be created before or after HA is enabled?Is Active-Passive HA preferred over Active-Active when using LACP with Cisco switch stacks?How should the Cisco side be configured (single port-channel across stack members, trunk mode, LACP active)?Are there any specific FortiOS settings or limitations for HA + LACP that I should be aware of?Are there any official Fortinet documentation or reference designs for this setup?I would appreciate guidance from Fortinet engineers or experienced community members, including recommended topology, CLI examples, or documentation references.Thank you in advance for your support.FortiGate

AEK · Accepted Answer

The following tech tip answers most of your questions (Q1, 4, 5 and 6): https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-setup-LACP-between-FortiGate-and-Cisco/ta-p/335667For Q2, it doesn't matter if you create it before or after enabling HA.For Q3, it is the same configuration for A-A HA and A-P HA, and there should be no preference when it come to LACP

Toshi_Esumi · Answer

The topology is as in the KB @AEK pointed you to, but only difference is in your case those cisco switches are stacked, which make them as a single switch. Therefore, all four ports in the KB example, need to have a different number each. Of course, you want to split two legs of a LAG/Port-channel to each physical switch.
The bottom line is, unlike cisco, FGT doesn't support LAG without LACP. You have to configure LACP on both sides.

L1/L2 come up even when the unit is a secondary/passive in a-p, and act as a single link. You would hook up and single link any time regardless both are separated or in HA, wouldn't you?
And, again, LACP is just a link, it wouldn't affect any HA operation, regardless it's a-p or a-a.

Toshi

Environment Details:

Objective:

Questions:

Sign up

Login with SSO

Login to the community

Login with SSO