Skip to main content
bdkey
bdkey
New Member
March 15, 2016
Question

OSPF in HA

  • March 15, 2016
  • 1 reply
  • 11888 views

We were hoping to leverage the OSPF capabilities between our Cisco Nexus Switches and the Fortigate in an Active-Active or an Active-Passive setup but we have run in to issues.

 

With the Nexus platform of switches, we have two ways to make a connection to devices:

 

An interface vlan, which creates a distinct vlan on each of the individually managed switches by utilizing Virtual Port Channel technology  to give each vlan on each switch its own ip address and a shared HSRP IP address. This works fine, but due to the nature of VPC and the manner in how OSPF uses the actual interface IP address, we have run into a VPC peering issue which does not allow Layer 3 routing information to route correctly over the platform. Because of this we can only set up static routes between the dual redundant Fortigate units and the pair of Cisco Nexus.

 

We also have the option of running layer 3 ports from each of the Cisco Nexus units individually. This would require each of the switches to have a unique layer 3 address on the port that connects to the Fortigates. In our research, we have only found examples of Fortigates utilizing a shared address. 

 

Is it possible to have a distinct IP address on the internal network ports of the Fortigates when using HA? 

 

Attached is a diagram of what we are attempting to do.

 

Thanks!

1 reply

lord_amarant
lord_amarant
New Member
March 17, 2016

if you want to use ospf i think you woul give a chance at FGSP.

 

http://kb.fortinet.com/kb/documentLink.do?externalID=FD36472

 

 

Benoit_Rech_FTNT
Staff
Benoit_Rech_FTNT
Staff
March 17, 2016

Hello,

On the Fortigate, the IP address is shared between the master and the slave device. So, only one FGT is used at a time.

A common deployment is to have each FGT connected to the two Nexus devices. In case of HA failover, the second Fortigate will take over.

To minimize the impact of the HA failover, you can:

* use lcap-ha-slave enabled, to prevent the LACP negotiation to be performed after the failover (the LACP links are already up, but are not used for the traffic).

* use OSPF graceful restart on the FGT and the Nexus, so the traffic with still goes through the Fortigate during the OSPF neighbor relationship completion.

 

Benoit

Nils
Nils
New Member
March 21, 2016

Otherwise you could connect each Fortigate to one Nexus and then you don't have to use a VPC and therefore use OSFP as you want.

So 2x1/10Gb interfaces connected from Fortigate1 to Nexus1 and 2x1/10Gb from Fortigate2 to Nexus2.

 

Edit: Didn't see that the post above gave the same suggestion.

    Terms & ConditionsAccessibility statement