Skip to main content
sonydarrel
sonydarrel
New Member
December 5, 2018
Question

fortigate Failover query

  • December 5, 2018
  • 1 reply
  • 6199 views

Dears

 

Please find the attached topology.

 

I have some problem in understanding the fail over, whenever the port channel interface of DC-1 fails it shifts over to DC-2 FW but the perimeter firewalls doesn't shift and the traffic gets drops, what should be done to make perimeter-2 FW to be active with DC-2 FW.

 

Thanks

 

 

    1 reply

    lobstercreed
    lobstercreed
    New Member
    December 5, 2018

    Hi Sony,

     

    Your physical design is flawed...the firewalls are not meshed.  You need to connect FG-INT1 to FG-DC2 and FG-INT2 to FG-DC1 so that you have true redundancy.  This can most easily be done physically if you can put a switch between the FG-INT and FG-DC FortiGates, but you could also achieve this logically with additional routed links.  Then it wouldn't matter that FG-INT1 was still operational when FG-DC2 took over. 

     

    Another thought is that you potentially don't even need 4 firewalls...  Assuming there's enough capacity, you can put the DC and perimeter all on one HA pair using different VDOMs if necessary.  We're a small shop, so we just run everything on one set of boxes that I manage (single VDOM).

     

    - Daniel Hamilton

    sonydarrel
    sonydarrelAuthor
    New Member
    December 5, 2018

    Dear

    i don't have additional switches what will be configuration according to your suggestion below

    You need to connect FG-INT1 to FG-DC2 and FG-INT2 to FG-DC1 so that you have true redundancy.

     

    Is the issue can  be achieved by remote link failover feature as per the link below.

     

    https://help.fortinet.com...A_failoverAttached.htm

    lobstercreed
    lobstercreed
    New Member
    December 5, 2018

    Sony,

     

    I think you're on to the best solution there with Remote Link Failover.  I haven't had to use that feature but it seems like it would be exactly what you need.  You could ping an interface on your Cisco Core and use that to determine the flip.

     

    Without a switch in between, the only other way I could see it working is by setting up additional links (assuming you have physical interfaces available) from FG-INT1 to FG-DC2 and FG-INT2 to FG-DC1.  You would then need to use a dynamic routing policy to manage the routes, but engineering all that sounds much more complicated than remote link failover.

     

    - Daniel

    Terms & ConditionsAccessibility statement