Connecting one FortiSandBox directly to two Fortigate which in HA

[Miron77]

Good day Community!

I'm trying to build a network architecture using FortiSandBox. I have two FortiGates in HA and one FortiSandBox. I understand from the documentation, that FortiSandBox uses port 3 for outgoing connection (for its VMs). I want to boundle port2 and port3 to connect directly to Fortigates (which're in HA).
For example, port2 will connect to port 2 of Fortigates 1, and port 3 will connect to port 2 of Fortigates 2. If communication with the active Fortigate 1 is lost, the connection to the Internet will be through the backup Fortigate 2.

Can I boundle outgoint interface with similar interface? 
If not,
How can I connect FortiSandBox directly to FortiGate 1 and FortiGata 2 (which're in HA) to provide redundant Internet access without a switch device?

I hope for your help!

Thank you!

[AEK]

Hi Miron

If it can help, we integrated in the past one FortiSandbox for a customer, and as far as I remember we connected port3 to FG HA (two nodes) through a L2 access switch through a dedicated VLAN.

e.g.:

• Created a new VLAN on the switch dedicated for this purpose
• Added only 3 physical switch-ports to this L2 access switch
• Connected FSA/p3 and FG1/pX and FG2/pX to these ports

The pX of the FG was also on a separate VDOM, wich is only dedicated for this purpose, having a second port going to the ISP router.

As far as I remember Fortinet recommends direct connection from FSA/p3 to FG because the traffic generated from the possible malwares can be harmful for your network in case the malware is real. But we don't really have choice when we have HA, so we managed to make this dedicated VLAN really isolated and can't access to anything else except internet.

Hope this helps.