Skip to main content
modgod
New Member
August 22, 2019
Question

HA A-P Cluster causing Loopback

  • August 22, 2019
  • 3 replies
  • 9679 views

Hi Guys and Gals,

 

Having some difficulty working out what best practices are for multiple switches in a HA A-P cluster.

 

At site 1 we have the following setup

 

https://imgur.com/bC2kNsT

 

At site 2 we have the following setup.

 

When I change site 1 to match site 2 we get a broadcast storm and another strange issue where the switch ports on the secondary fortigate start giving DHCP/internet access, needless to say things didnt work and we reverted to the original topology.

 

The only difference is STP is turned on in the hardware switch settings for the fortigate other than that everything else is the same. I've checked and I dont see a loop anywhere in the rack or on the floors. Why is this config that works at one site not working at another?

 

What is the best practice for an A-P cluster, if I have the switches connected like site 1 will clients connected to both switches retain network and internet access if the secondary fortigate takes over?

    3 replies

    orani
    New Member
    August 22, 2019

    Site 1 images does not show up

    modgod
    modgodAuthor
    New Member
    August 22, 2019

    click on the link please, I could not get it to display in the thread.

    KPS
    New Member
    August 22, 2019

    Hi!

     

    Did you configure the links to the switches on each FG as A/P-Bond, or did you just switch them?

    modgod
    modgodAuthor
    New Member
    August 22, 2019

    the links to the swithes on each fortigate are just standard ports that are part of the hardware switch on the interfaces page.

     

    how do I AP bond them, are you referring to a creating a redundant interface.

     

     

    Markus
    New Member
    August 22, 2019

    Hi In short, yes the secondary will take over, depending on the confgured monitors.

     

    Best practices in A-P isn't to crosscabling the Fortigates.

     

    https://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-high-availability-52/HA_failover.htm

     

     

     

    KPS
    New Member
    August 22, 2019

    Hi!

     

    I would always prefer redundant cabeling. Using a failover-bond is easy and does not force a failover in case of a switch-reboot...

    modgod
    modgodAuthor
    New Member
    August 22, 2019

    could you give a diagram of this redundant cabling, when I cable things as per the fortinet diagram I get a loopback?