Atypical HA config with two ISPs

[SigniVain]

Howdy,

Perhaps you can shed some light on the following.  We have two Fortigate 300Ds (v6.2.3) in an Active-Passive HA cluster.  Up to now, only the Primary unit has had the "outside" interface (let's call it WAN1) plugged in; we don't have a switch between the Fortigate and the ISP (ISP1) in order to have WAN1 plugged in on both Primary and Slave.

Now, we have a second internet pipe (ISP2).  I know the typical deployment would have a switch between each Fortigate in the HA cluster and the ISP:

[ul]

Primary WAN1 = ISP1

Primary WAN2 = ISP2

Secondary WAN1 = ISP1

Secondary WAN2 = ISP2[/ul]

The above would be ideal, but I need to make things work without the upstream switches.

Here are the requirements:

If ISP1 is having issues, which is plugged into Primary WAN1, HA fails over to Secondary which has ISP2 plugged into WAN2.

If I keep ISP1 plugged into Primary WAN1 (Secondary WAN1 has nothing plugged in), and plug ISP2 into Secondary WAN2, is it as easy as setting up link monitoring, adding the default route, and adding the WAN2 interface of the HA cluster to the existing WAN1 policies?  Any issues with keeping HA as Active-Passive?

Here's the kicker, we're advertising a /24 to ISP1 via BGP.  I won't be able to set the secondary IP address of WAN2 to anything in the /24 advertised by WAN1.  This might be a whole different topic, but in order to achieve all of the above *AND* advertise a /24 via BGP, would creating an SD-WAN interface be the way to go (add both WAN1 and WAN2 to the SD-WAN interface)?

Thank, in advance, you for your guidance.

[brycemd · Accepted solution]

If you setup a link monitor to down the port(wan1) rather than just remove the route it might failover to secondary as connected ports is the main criteria for primary HA selection. But, even if it does work, I do believe a WAN switch is by far the way to go.

[James_G]

Whats stopping you putting a switch between WAN1 ports and ISP

[SigniVain]

Rack space, cost, and the powers that be. :)

[James_G]

I don't think you would be able to have an ISP failure trigger an HA event, you would be better with switches, even if they were $20 5 port jobs.

You would have a 5 port switch for each ISP, so still no SPOF, worst that happens on switch failure is it fails to secondary ISP.

[brycemd · Accepted solution]

If you setup a link monitor to down the port(wan1) rather than just remove the route it might failover to secondary as connected ports is the main criteria for primary HA selection. But, even if it does work, I do believe a WAN switch is by far the way to go.

[emnoc]

Seriously you are doing 2x ISP upstream with BGP and you're balking over cost a single switch, 1U of rack space,.... and you rather to  in some wacked-hackup-job  of  HA deployment in place with 2x FGT300D that cost approx 900 usd each before subscription bundle. Seriously? That make no sense form my standpoint.

If the FGT300D are in a HA cluster how did you connect the internal LAN connectivity ? A switch ???

Ken Felix

[SigniVain]

I ask that you take into account that I am not a decision maker.  This directive was bestowed upon me, and I'm trying to figure out a solution within its confines.  Any and all help is appreciated.  I agree switches/a switch upstream of the HA cluster is "best practice."  It's the correct way, it's the easiest way, and offers the most redundancy.  I agree with all of it.  Alas, I'm still in the same position, and am reaching out to the community for guidance.

Perhaps changing from Active-Passive to Active-Active will help?  Sure, the WAN1 and WAN2 interfaces won't be redundant between the Primary and Secondary, but, in theory, it seems like ISP redundancy can be achieved.  May not even need an SD-WAN virtual interface.  Input is greatly appreciated.

[James_G]

I think the guidance you need to feedback to management is that it's impossible to automate fail over in the suggested configuration.

Management either accept the risk, or fix it. Let them decide.

[lobstercreed]

I don't think you answered Ken's question about what is on the inside of the HA cluster?  If you have a switch there, just use a dedicated VLAN on 3 ports for each ISP.  Yeah it consumes 6 switch ports, which if you're down to your last $20 as someone else pointed out, might be too much, but...

I agree with James.  Tell management it can't be done.  Make them accept the risk for the want of a few bucks.

[SigniVain]

Sorry, I figured that was a rhetorical question.  There is a router on the inside of the HA cluster.  This device must stay "clean," and not be directly connected to the public.