Skip to main content
Oucean
Oucean
New Member
March 5, 2024
Solved

In FortiGate HA architecture, will the spare FortiGate still be functioning as a L2 switch

  • March 5, 2024
  • 2 replies
  • 2193 views

Hello Everyone

 

Our customer has a FortiGate network that only contains 1 FortiGate FG-200E firewall. Now they want to purchased another FG-200E firewall and make an HA build.  But to reduce failure points, we are thinking if we don't need Switches for this HA build. Then I'm wondering, is it possible to enable HA for two FortiGate firewalls without any switches and hosts under two firewalls can all work fine?

 

For example, like below topology. VLAN 101 was there on both FortiGate firewalls with private IP address 10.1.1.1/24. This VLAN is used to connect with each other and to the hosts under them. Then, when the Secondary FortiGate works in Spare mode, will its LAN ports in the same VLAN still be functioning as a L2 switch and make Server 2 be able to access Internet via Primary FortiGate? Thanks a lot.

FortiGate HA.jpg

Best answer by AEK

Hi

I don't think this is a good idea. Even in the case a passive FG can work as L2 switch (but I don't think so), you have to consider the case where your FG is completely down, and in that case your server will be completely isolated.

On the other hand you can modify a bit your architecture if you want to avoid extra switches, is to connect each server to both FG nodes and by using IP multi-pathing at server level. But still it is only workaround and not so ideal for production.

That said the best solution is to purchase a pair of L2 switches.

Check this post:

https://community.fortinet.com/t5/Support-Forum/FG-100F-in-HA-without-using-switches/td-p/294713

2 replies

AEK
SuperUser
AEKAnswer
SuperUser
March 5, 2024

Hi

I don't think this is a good idea. Even in the case a passive FG can work as L2 switch (but I don't think so), you have to consider the case where your FG is completely down, and in that case your server will be completely isolated.

On the other hand you can modify a bit your architecture if you want to avoid extra switches, is to connect each server to both FG nodes and by using IP multi-pathing at server level. But still it is only workaround and not so ideal for production.

That said the best solution is to purchase a pair of L2 switches.

Check this post:

https://community.fortinet.com/t5/Support-Forum/FG-100F-in-HA-without-using-switches/td-p/294713

AEK
    Oucean
    OuceanAuthor
    New Member
    March 6, 2024

    Hello AEK

     

    Thanks for your reply. For your first point about FG is completely down. I've considered this situation actually. But I think adding a pair of L2 switches will be similar. If I add a pair of L2 switch in this design, the server will be completely isolated as well if one switch is completely down. That's also the reason I'm thinking if a switch is really required. But if the passive FG can't work as a L2 switch. Then this is not doable...

    And for the other point, I think that may be a good idea. Actually I'm also considering if I can use a feature named NIC Teaming on Windows OS to avoid extra switch. But the thing is, I can't find any detail document about how NIC Teaming is working. I can use two NIC port on the servers to connect to both FG. But if those two ports are all UP. Will the OS sending traffic to both ports even one port is connecting a passive FG? If so, then it will bring issues. Maybe the best way is just to do a POC test. But the awkward thing is...Our customer will purchase the secondary firewall only if this design will work......o(╥﹏╥)o

    AEK
    SuperUser
    AEK
    SuperUser
    March 6, 2024

    Hi @Oucean 

    No, if you add a pair of switch (stack, mlag, ...) and use LACP to connect each server to both switches then in case one FG is down or one switch is down the  your server will still be accessible.

    For the second option (no switch), even I find this design a bit ugly, and probably no one firewall vendor has documented such design, (and I'd never do that in prod except in lab), I think you need to select the right teaming/IPMP algorithm that must be L3 based, not L2 based, otherwise as you said it might be possible to have a bad side effects. I didn't have a time te test it, so for sure you need to do a PoC.

    Another bad side effects is even if this design works, in case one day you have some issue related to this design then Fortinet support "may" tell you this design is not supported and you need to add L2 switches.

    AEK
      hbac
      Staff
      hbac
      Staff
      March 5, 2024

      Hi @Oucean,

       

      I don't think so as the passive FortiGate won't forward any traffic. 

       

      Regards, 

        Oucean
        OuceanAuthor
        New Member
        March 6, 2024

        Hello hbac

         

        Thanks for your reply. So even the L2 switch function will not work, right? May I know if we have any tried on this point? Of course the best way is that I just do a POC test for this. But the awkward thing is...Our customer will purchase the secondary firewall only if this design can work......o(╥﹏╥)o

        Terms & ConditionsAccessibility statement