Question about VRRP with FGCP

This is why VRRP on a fortigate or any other vendor needs to be carefully analysis before deployment.

You argument for need to manage the 2 firewall  & 2 unique systems is Questionable imho. You are adding more points of failures and more complexity ( more firewall policies to managed across each firewall-gateways )  to a solution that's already simplified if you just ran FGCP and in a A-A or A-P mode.

Now with that said here what might work for you . Could you deploy dead gateway detect or vrdst on internal lan segments routes into the stack? ( just a guess here )

Could you run a 802.3ad bundle split between  2x members with each member on one stack'd switch ( i.e vPC in cisco lingo ),so your port-channel would be like this;

bond0

# alias  inside-interface INSIDE/INTERNAL

 port 1 (  inside  stack-switch 1 )

 port 2 (  inside  stack-switch 2 )

bond1

# alias  inside-interface DMZ

 port 1 (  DMZ  stack-switch 1 )

 port 2 (  DMZ  stack-switch 2 )

This might get away from the just one single link failure issue.

BTW  VRRP is great if you have a firewall hardware failure , but can wreck havoc when it's a just a single link failure. I don't know or think fortigate has  VRRP group and object tracking available to the same degree as cisco btw. But you might to read up on any new VRRP HA features in the latest code.( I'm too lazy at this time todo that from the location I'm currently at )

Hello, You choose VRRP to manage your firewall separately ? this is the only reason ? So your installation is active passif ? is that correct ? you don't use one firewall for one subnet, and the second for the other ? If that correct, I suggest you to use FGCP, like that you can : - create a dedicated management interface on both firewall : conf sys ha, set ha-mgmt-status enable, set ha-mgmt-interface mgmt, set ha-mgmt-interface-gateway "yourDMZMgmtgw(your VIP)" - disable sessions sync : set sync-config disable - finish to configure your HA (the rest is basic config) With this solution, you will have a correct HA system, without synchronisation of the config..

Lucas

Hi emnoc,   Thanks for your reply. I'm new to Fortinet. unfortunately it seems fortios cannot provide HA mechanism like juniper nsrp or cisco hsrp.

Correct, but I would word it as; it ( fortinet ) is not as  robust as  jnpr's  NSRP or  csco's HSRP/GLBP/VRRP."  Than again your comparing features found primarily on routers to a firewall.

All of the layer3 redundant gateway protocols have some type of track ( ip, protocol, routing,etc.....) . Fortinet implementation at this time does not.

Maybe you should ask for a feature enhancement to  FortiOS to give you  a track-ip/port function