Skip to main content
dur
dur
New Member
June 18, 2018
Solved

High Availability & WAN Design Failover

  • June 18, 2018
  • 1 reply
  • 5849 views

Hello,

 

I've a question regards WAN failover and HA A/P design that I can't find the answer anywhere in the documentation.

 

 

Please check the attached diagram designed, the question that comes in mind is:

[ul]
  • If the link WAN1 from CORE1 to Port1 on of FS-1 goes down, then the Internet connectivity will be done through CORE1 - WAN2 as far as I understand.
  • Is it possible to set it up, that instead of failover to use CORE1-WAN2 it uses CORE2-WAN1? The only way I've seen to set up this scenario is to enable port-monitoring on CORE1-WAN1 and then failover to CORE2. But in my opinion it seems a bit of extreme use to failover to CORE2 just only because the link between CORE1 WAN1 / FS1 Port1 fails.[/ul]

     

    Thanks for your help.

    • Best answer by Toshi_Esumi

    With FortiGate HA a-p mode, both unit has basically the same config (copied over from a to p). So if you set up a fail-over from wan1 to wan2 on the current active, the standby unit has the same config and duplicate the fail-over operation if a-p roles are flipped. 

    How let the standby unit take over the control from the active unit is a completely separate issue and you can control it by monitoring interfaces.

    By assuming wan1-ISP1 and wan2-ISP2 are pairs, I would set up a fail-over mechanism wan1->wan2 with some optional split traffic first, then set up HA a-p between two 200Es. Much more complicated fail-overs are probably possible, but it wouldn't fit with HA a-p and more importantly wouldn't add much benefits in my opinion, other than more complicated troubleshooting/isolation process when a fail-over situation happens.

    1 reply

    Toshi_Esumi
    SuperUser
    Toshi_EsumiAnswer
    SuperUser
    June 18, 2018

    With FortiGate HA a-p mode, both unit has basically the same config (copied over from a to p). So if you set up a fail-over from wan1 to wan2 on the current active, the standby unit has the same config and duplicate the fail-over operation if a-p roles are flipped. 

    How let the standby unit take over the control from the active unit is a completely separate issue and you can control it by monitoring interfaces.

    By assuming wan1-ISP1 and wan2-ISP2 are pairs, I would set up a fail-over mechanism wan1->wan2 with some optional split traffic first, then set up HA a-p between two 200Es. Much more complicated fail-overs are probably possible, but it wouldn't fit with HA a-p and more importantly wouldn't add much benefits in my opinion, other than more complicated troubleshooting/isolation process when a fail-over situation happens.

    dur
    durAuthor
    New Member
    June 23, 2018

    Thanks for the answer Toshi, very much appreciated! :)

    Terms & ConditionsAccessibility statement