Best practice for connecting HA L3 Switch to HA (A/P) FortiGate?

[carl00]

My searches have come up empty handed, and support says it is out of their scope.

In my environment, I have an Active/passive pair of 201Fs directly connected to a single Cisco Nexus switch. I plan to add a second Nexus in a vPC configuration.

Ideally, switch A would have a link each to the Active and Passive FortiGates, and switch B would have the same. In reading some other forum posts, it sounds like this causes unexpected behavior.

For anyone that has accomplished this, could you point me in the right direction?

Thanks, in advance

[ede_pfau]

Hi,

yes it may cause trouble.

Traffic from the active FGT (this is the only one that counts) will traverse to sw1 AND sw2. The destination will see traffic coming from different switches/ports.

What you can do is

- set up RSTP

or

- cluster the switches

I am not trained on Cisco equipment, maybe you are planning this with the "vPC" config anyway.

The only thing to note then is that you need _one_ LACP trunk per FGT, with at least 2 members running to sw1 and sw2. In this configuration, you can lose one switch and avoid having a HA failover of the FGTs.

BTW, there is a know incompatibility between Nexus and FGT HA. Both use a special ethertype.

You find notes on this in the Handbook:

"Some third-party network equipment may prevent HA heartbeat communication, resulting in a failure of the cluster or the creation of a split brain scenario. For example, some switches use packets with the same Ethertype as HA heartbeat packets use for internal functions and when used for HA heartbeat communication the switch generates CRC errors and the packets are not forwarded."
and

"By default, HA heartbeat packets use the following Ethertypes:...0x8890, 0x8891, 0x8893"

You can reconfigure these ethertypes on the FGT. Nexus will use 0x8890 AFAIK.