Skip to main content
hguo83
hguo83
New Member
August 20, 2020
Question

Redundant interface on 1 x firewall connecting to 2 x firewalls in a HA cluster

  • August 20, 2020
  • 1 reply
  • 3535 views

I have 2 x Locations - Site A and Site B

 

Site A - 1 x F201E (FW-101)

Site B - 2 x F201E in HA cluster mode (FW-601 and FW-602)

 

in Site B, a fiber cable is connected to Port 15 each on the pair of firewalls (2 x fiber cables in total)

in Site A,  FW-101's Port 15 is connected to FW-601 and Port 16 is connected to FW-602 using the fiber cables

 

Site B : port 15 - 192.168.11.22/30

Site A : Redundant interface (members : port 15 and 16) - 192.168.11.21/30

 

Redundant Interface is up and point to point link is working when the master is FW-601 but when I failed over to FW-602, the link and interface is still shown as up but I cannot ping nor route traffic through the point to point link anymore.

 

How can I make this point to point link work in my scenario ? Thanks for helping in advance

 

 

    1 reply

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    August 20, 2020

    I wouldn't build a redundant network this way with those given circuits and equipment, and I would assume redundant interfaces are generally terminated by a switch or another FGT with the same set of redundant interfaces.  But at the same time, I also assume this would work. So let me ask some questions.

    First, how did you trigger the HA fail over? Did you simply disconnect the primary cable, which is monitored by the HA at site B?

    Then, what was the physical interface status terminating those circuits on site A when the failover happened. You probably need to use "diag hard deviceinfo nic <port_name>" to see it.

    hguo83
    hguo83Author
    New Member
    August 21, 2020

    I trigger the failover by rebooting the master firewall in Site B , the standby firewall will then become the master firewall.

     

    the physical interface terminating the point to point link at Site A will be the Redundant Interface (Port 15 + Port 16) that i created in the firewall right ?? Isn't it one virtual mac-address only or 2 different mac-addresses ?

     

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    August 21, 2020

    I don't know if MAC address is the same on the redundant interfaces or not. But rebooting the primary FGT at site B wouldn't keep the site A FGT using the secondary circuit. It would switch to the secondary when you rebooted it because it sees the link went down. But when the rebooted FGT comes up as a standby in HA, the link would come up so the site A FGT would swap it back to the primary. The standby's ports are active in L1 and L2, just doesn't send or receive packets.

     

    Terms & ConditionsAccessibility statement