BGP/EBGP from ISP to Fortigate HA A/P

EM_Fortiuser · ‎06-19-2024

I have been discussing if a Fortigate HA in A/P can work with BGP/EBGP from a single ISP. So I wanted to see what exactly is possible. The ISP was going to be providing the routing on their side with my firewalls accepting the connection. I have put a logically diagram of what I am looking to build.

Pittstate · ‎06-25-2024

This sounds very similar to what I have just implemented, and is very doable. We went from a standalone to HA implementation so wasn't exactly sure what to expect as far as cluster behavior with the A-P. As Toshi said, the two FGs will be sync'd so they will have the exact same configuration. For instance, port 1 on the Active, will fail over with the exact same configuration on the Passive. Also, the interfaces on the Passive will show as link UP on any connected equipment, but it will not participate in any traffic related activity until it becomes the Active FG in a failover situation. So it is not participating in BGP sessions until it becomes the Active partner. When it becomes the Active it will make all connected interfaces fully active, bring L3 routing protocols up and start advertising routes on it's outside/ISP connected interface.

Like you, we are also single connected to our ISP at each location and each location has it's own /30 interface to the ISP's network. In our HA setup, FG1 (active) port 1, is connected to ISP router 1, and FG2 (passive) port 2 is connected to ISP router 2. This seemed to be the simplest way to solve the ISP connectivity problem without more fiber between sites, or implementing a router redundancy protocol. When things run normally, traffic routes out through FG1/ISP router 1. When things failover, traffic switches to FG2/ISP router 2. On failover, it does take a little bit to get the passive fully up on L3. In my lab it seemed like it took about 10-15s or so for the passive FG to come up and start advertising BGP routes, then an additional 90s or so for BGP timers to timeout and routes to appear where they should. We ended up targeting a 60s failover (from failure of Active to Passive up, full BGP routing advertisement, and traffic being routed correctly). Using BFD and tweaking BGP options/timeout values, and maybe some other FG magic, you can definitely bring that time down. I'm not a WAN guy, I'm sure there are better/quicker ways. This config and tolerances work for us.

View solution in original post

EM_Fortiuser · ‎09-08-2025

Basically you have 2 different ports with 2 different ips configured. ie. ISP 1 on port 3 and ISP 2 on port 4. Create a zone for the WAN ports to use in your rules.

BGP/EBGP from ISP to Fortigate HA A/P

Nominate a Forum Post for Knowledge Article Creation

You are leaving our website