Fortigate freezes when Wan 1 and Wan 2 are connected

I believe you caused some kind of loop on the system, so more traffic then it can handle. The only way to look at it will require ' diagnose sniffer packet' while you make the bad connection. it will probably die on you again but you will see what network looped or something.

Maybe this helps in troubleshooting: http://kb.fortinet.com/kb/viewAttachment.do?attachID=Fortigate_Transparent_Mode_Technical_Guide_FortiOS_4_0_version1.2.pdf&documentID=FD33113 If the ASAs are running A/A, this could be checked as well: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/ha_active_active.html

To avoid having duplicate MAC addresses on your network, make sure you assign each physical interface a virtual active and standby MAC address.

I spoke to Fortinet Technical support about this issue and was told the following. In transparent mode, trying to use two use both wans will not work because you cannot set priority on the routing table therefore, both port1/wan1 and port2/wan2 will fight to take priority and cause the device to fail into bypass mode. Typically in a nat mode implementation, you can create the routing tables and set priority to resolve this issue but those features for whatever reason in transparent mode are not available. From documentation: In transparent operating mode, all physical interfaces act like one interface. The FortiGate unit essentially becomes a bridge — traffic coming in over any interface is broadcast back out over all the interfaces on the FortiGate unit. In transparent mode, there is no entry for routing at the main level of the menu on the web-based manager display as there is in NAT/Route mode. Routing is instead accessed through the network menu option. ----- One potential solution which I am currently reviewing is the possibility of enabling VDOM and creating a VDOM for each of my " zones" to prevent the broadcast from causing a device shutdown. I am not quite sure this will work but will update once i get a firm answer. Cheers and thanks for your reply' s -Phil

So i got a more concrete answer from a fortinet tech, and maybe this sounds like basic knowledge now but here it is. In order to do what I am thinking of doing, in transparent mode, the only way to achieve this is to create two separate vdoms. unfortunately this also means you have to recreate all your policies twice, once per vdom, and there is no way to replicate policies accross each vdom. except for some export/import via cli but that only helps for some of the configuration. Even when I get my second device in for redundancy its not recommended that I HA cluster them because it will necessitate a full mesh setup that is not worth the additional configuration for the size of our network. Needless to say there is no way I can avoid managing two identical sets of policies whether its on one device using VDOM or two separate devices. oh well...on to the next problem

In order to do what I am thinking of doing, in transparent mode, the only way to achieve this is to create two separate vdoms. unfortunately this also means you have to recreate all your policies twice, once per vdom, and there is no way to replicate policies accross each vdom. except for some export/import via cli but that only helps for some of the configuration

More than one person here will tell you to load a backup of the config into a text editor, copy the relevant sections of the config into a separate text file -- edit the references of this new section, then paste it back into the new vdom location in the original config. (If you plan to do this, I suggest back up the original config then split the fgt into two vdoms and save/use that config.) Edit: it will be more involving setting up the new vdom and getting the interfaces properly matching under old/new sections, so not quite sure what is involved.

An alternative is to take a look at using port-pairs and setting forward-domains, we have an 800C doing transparent inspection on one of our WAN links that is carrying two VLAN' s. As traffic is all vlan tagged we had to create sub-interfaces to see the traffic, however once we did we were seeing traffic from vlan 50 on both vlan 64 routers (at both ends of the WAN)

800C (IPS) # show system port-pair  config system port-pair      edit " BB-50"           set member " BB-50_north"  " BB-50_south"       next      edit " BB-64"           set member " BB-64_north"  " BB-64_south"       next  end    800C (IPS) # show system interface BB-50_north  config system interface      edit " BB-50_north"           set vdom " IPS"           set forward-domain 50          set interface " port1"           set vlanid 50      next  end    800C (IPS) # show system interface BB-50_south  config system interface      edit " BB-50_south"           set vdom " IPS"           set forward-domain 50          set interface " wan1"           set vlanid 50      next  end    800C (IPS) # show system interface BB-64_north  config system interface      edit " BB-64_north"           set vdom " IPS"           set forward-domain 64          set interface " port1"           set vlanid 64      next  end    800C (IPS) # show system interface BB-64_south  config system interface      edit " BB-64_south"           set vdom " IPS"           set forward-domain 64          set interface " wan1"           set vlanid 64      next  end    800C (IPS) #

Regards, Matthew Mollenhauer