Skip to main content
Infrarium
Infrarium
New Member
January 2, 2023
Solved

HA Active-Active and Asymmetric Routing

  • January 2, 2023
  • 4 replies
  • 8874 views

Hello everyone,

 

I have two fortigate units in standalone mode and both have asymmetric routing enabled. I would like to re-design my network in order to not enable asymmetric routing since enabling it is a (very) bad security practice.

 

dibujo1.png

 

So, here is the diagram of the network. The fortigates are not in cluster.  What happens is that L3 switches load balance the traffic that originates behind them in a round-robin fashion using wan link 1 and wan link 2. Traffic may go using wan link 1 and come back using the other wan link. In order to overcome this, we enabled asymmetric routing (long back ago) and its working since then, no issues. Today we want to re-design the network to avoid the use of asymmetric routing since its a bad security practice.

 

I came with several designs, but in every  one of them i have my doubts:

 

1st design: Active-Pasive cluster, both wan links enter the same fortigate unit so no asym routing enabled. The problem with this is that the master FG unit fails, both wan links fail and i have to go and manually change the cables to the slave FG.

 

2nd design: Active-Pasive cluster, sames as before, but with one wan link in each FG unit. The problem with this is that im wasting a whole wan link, and i MUST use both at the same time.

 

3rd design: Active-Active cluster, but here i have even more doubts, because i do not have real world experience with active active clusters and i dont see how it can address the asymmetric routing problem.

 

Any help would be appreciated, thank you in advance!

    Best answer by gfleming

    You can invest in two small 8-port switches for each WAN link. Not a heavy invesetment. And now you have full HA redundancy in a sound design.

    4 replies

    gfleming
    Staff
    gfleming
    Staff
    January 3, 2023

    Please review the High Availability information in the FortiGate documentation it has lots of good info: https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/666376/high-availability

     

    You have some misconceptions about how it works and I will summarize for you:

     

    1. A-P Cluster, both FGT units will have wan1 and wan2 connected. If FGT1 fails, FGT2 takes over automatically and there is no break in connectivity. The FGT uses a virtual MAC address to ensure IP connectivity over either FGT.

     

    2. A-P cluster cannot operate in this fashion. Please review the "Critical Cluster Components" on this page: https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/62403/fgcp (you need identical interfaces on both units)

     

    3. A-A is really only used to offload security processing to two or more units. All regular traffic will still traverse the primary gate.

     

    In your situation I would highly doubt you actually need A-A set up in any way. A-P should suffice just fine. Review the FGCP A-P documentation and you will see it's not hard to set up and get going.

    Infrarium
    InfrariumAuthor
    New Member
    January 4, 2023

    Thanks for the fast answer!

     

    Yes, i should try to set up a AP cluster, the only thing that still remains is that both wan links end in the same FG unit, and i must use both of them simultaneosly, so i need to put a switch in between the FG units and the L3 switches so traffic can flow to the slave FG in the case that the primary fails.

    gfleming
    Staff
    gfleming
    Staff
    January 4, 2023

    You already have switches according to your diagram. Assuming you have free ports in those switches you can use those for the WAN links. You would need three ports per WAN link (one for the WAN link, one for each FGT connection). 

    pminarik
    Staff
    pminarik
    Staff
    January 4, 2023

    Standard A-P/A-A FGCP cluster design assumes that a link is connected from a switch to both units, e.g. Switch connects the ISP1 link to both FGT1 and FGT2, and also connects ISP2 to both FGT1 and FGT2. Same with downstream links. The failover happens on layer2 by the cluster MACs moving from one FGT to the other (GARP, or link flap).

     

    Can you find two additional ports on the L3 switches to wire things up like this standard FGCP design? If not, what's blocking you from doing so?

    Infrarium
    InfrariumAuthor
    New Member
    January 5, 2023

    I can do what you say but only on one side of the diagram, the other L3 switch is physically separated from the FG units and I only have one fiber cable for each WAN link, no switch in the middle. 

     

    What i can do is get a switch to put in the middle, but if its a single switch then i have a single point of failure and thats a thing that i dont really want to add to my network topology.

     

    pminarik
    Staff
    pminarik
    Staff
    January 5, 2023

    You could try doing it with a hard-switch, similarly as shown in the document here - https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/931221/configuring-sd-wan-in-an-ha-cluster-using-internal-hardware-switches , but that setup is still sub-optimal. If the Unit with the physical connection to ISP-X goes fully down, the other unit won't have access to that ISP-X. There is no way around this bottleneck without having ISP-X linked to both FortiGates.

    Infrarium
    InfrariumAuthor
    New Member
    January 5, 2023

    I thank you for the fast responses and all the documentation and help you have provided me on this matter. Seeing the HA documentation of Fortigate units I saw this:

     

    https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/668583/fgsp

     

    Could FGSP be useful in this case? The documentation says that: "FGSP is primarily used instead of FGCP when external load balancers are part of the topology, and they are responsible for distributing traffic amongst the downstream FortiGates."

     

    Since my topology consist of two L3 switches that load balance the traffic between the wan links, could this be a case where FGSP is the best option (instead of a FGCP cluster)?

    pminarik
    Staff
    pminarik
    Staff
    January 5, 2023

    Pay attention to this line: "The load balancers should be configured so that all packets for any given session are processed by the same peer, including return packets whenever possible."

     

    FGSP needs session-aware load-balancing. If your L3 switches can balance like this, you could try it, but I'd wager a guess and say that it's unlikely.

     

    Lastly, the wiring requirements are still the same with FGSP as with FGCP, if you're looking for proper failover between both ISPs and both FortiGates.

    Infrarium
    InfrariumAuthor
    New Member
    January 9, 2023

    Hello everyone, 

     

    After all, I believe that the best thing to do here is get two small switches to put in the middle of the FG units and the L3 switch that is far away, in order to solve the problem of the links termination. So if one FG unit fails, the other takes over right away and has both WAN links.

     

    Thank you for all the help you gave me on this matter.

     

    Cheers.

    Terms & ConditionsAccessibility statement