HA Network Design

The best design would be putting a switch (or current out of a section of existing L3 switch) inbetween FGT-HA and those routers in HA.

Toshi

Hi ishigai,

Toshi's suggestion of adding a switching layer between the FortiGate HA cluster and the WAN router HA pair is worth considering.

From a high-availability perspective, the design should allow both FortiGate units to maintain connectivity to the WAN router layer during a failover. If a single switch is introduced, it is also important to consider whether it would become a single point of failure.

From a routing perspective, moving the Layer 3 gateway function from the core switch to the FortiGate changes where routing decisions are made. The routing design should therefore provide clear next-hop paths between the FortiGate and WAN routers, with appropriate handling of failover to avoid routing loops or asymmetric traffic.

The final topology will depend on the physical connectivity and redundancy mechanisms in use, but the key is to design the firewall HA, router HA, and intervening switching layer as one end-to-end redundant path.

For reference, please see Fortinet's documentation on HA with redundant interfaces.

I hope this provides another perspective on the design considerations.

Thank you, Toshi_Esumi and Osoleimani.
For a better perspective, please refer to the layout below.

“Your suggestion is to add another hardware device in between, correct? Something similar to the layout below?”

Would a redundant interface provide proper failover if one of these components becomes unavailable, or would another interface type be more appropriate for the network topology shown in the first layout above?