Active Active Firewall 1200D

[sonydarrel]

Dears

This is my new installation of 1200D i have a Cisco Nexus acting as a core for the campus which are connecting to the 1200D, my question is my both Nexus core are active (forwarding traffic) i also want my 2* 1200D firewall to be in active active state as it is not configured for any VDOM is it possible ???  i am having a cisco asa firewall knowledge where an asa can be active active only in multiple context mode, it means for context A--- FW-A is active and FW-B is standby for context B ----FW-B is active and FW-A is in standby.

[gschmitt]

sonydarrel wrote:

This is my new installation of 1200D i have a Cisco Nexus acting as a core for the campus which are connecting to the 1200D, my question is my both Nexus core are active (forwarding traffic) i also want my 2* 1200D firewall to be in active active state as it is not configured for any VDOM is it possible ???

Could you describe the setup a bit more?

If I understand you correctly you want an Active-Active HA Cluster. This is doable. Simply select "Active-Active" in the HA Config Menu instead of Active-Passive

[emnoc]

Are you running multi-vdoms? with virtual-clustering you can run multiple vdoms on each  fortigate in the same fashion as the cisco multi-contexts & load-balane vdoms.

or

If you want to run pure A-A and loadblance sessions be aware of the limits and what can or pretty much not load-balance. Here the Active ( master ) unit controls pretty much all sessions allocations  based on lb or weighted by assignment of the virtual-mac. If your familiar with cisco GLBP, than you will understand the fortigate A-A concept.

[sonydarrel]

Dear,

I am not running any VDOMS still i can configure the 2 * fortinet as A-A,  this is not possible in Cisco, as per gschmitt reply it is it is doable just by choosing A-A in the HA config, so this mean both the firewall can forward traffic though they are in no multiple VDOMS

Please confirm my thoughts.

thanks

[storn]

Hi,

you can run Active-Active with only one VDOM. This is referred to as "UTM Offloading" where the primary unit offloads UTM-enabled sessions to the subordinate unit(s) (Units, because fortigate clusters can grow up to 4 units).

You can enable the cluster to also offload TCP and UDP sessions (without UTM enabled), but this is not recommended since all sessions will be first handled by the primary unit, only heavy UTM session offloading can result in higher throughput.

Note that is is not load-balancing, but rather load-sharing what you're about to accomplish. Active-Active in the Cisco mind is called Virtual Clustering on FortiGate.

Regards,

Steffen