Skip to main content
fatihak
Explorer II
May 17, 2024
Solved

Switch forwards packets to Fortigates as if there is load balance, but there is no load balance

  • May 17, 2024
  • 2 replies
  • 1279 views

I have 2 fortigate clusters on my network. One is for sslvpn and the other one is for the internet(rest of the traffic other than sslvpn). They are connected to the internet router via a switch in between. They both have different public IP addresses, however, when i ping sslvpn firewall from outside, packets arrive to both internet and sslvpn firewalls as if there is a load balance (I sniff the trafic using sniffer command). It is very confusing bcs the IP addresses are different and there is no load balance at all. What can be the reason behind? Or do you have any other recommendations for tshoot? Thx in advance 

sslvpn -> 400F (active passive ha)
Internet -> 600E (active passive ha)

Best answer by atakannatak

Hi @fatihak ,

 

In your network structure, this issue likely arises because both cluster firewalls are connected to the same Layer 2 segment and may have the same MAC addresses on the relevant switch.

 

After checking the MAC addresses of the firewalls in the cluster, if they are using the same values, you can change the group-id value in the HA configuration by following this document. This will generate a unique MAC address using the specified group-id value.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-A-conflict-HA-virtual-MAC-address-in-the-different/ta-p/189577

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-HA-Cluster-virtual-MAC-addresses/ta-p/194239

 

BR.

 

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

2 replies

ozkanaltas
Valued Contributor III
May 17, 2024

Hello @fatihak ,

 

When you look at the arp table of the switch to which the FortiGates are connected, can you see the macs of the FortiGates separately?

 

Also, are the public IP subnets defined in FortiGates different or the same?

 

atakannatak
Explorer
May 17, 2024

Hi @fatihak ,

 

In your network structure, this issue likely arises because both cluster firewalls are connected to the same Layer 2 segment and may have the same MAC addresses on the relevant switch.

 

After checking the MAC addresses of the firewalls in the cluster, if they are using the same values, you can change the group-id value in the HA configuration by following this document. This will generate a unique MAC address using the specified group-id value.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-A-conflict-HA-virtual-MAC-address-in-the-different/ta-p/189577

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-HA-Cluster-virtual-MAC-addresses/ta-p/194239

 

BR.

 

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.