Dual WAN links with HSRP

[#1]

I have Fortigate 110C box, connected to two upstream routers configured with a virtual HSRP address, with one connected to wan1 and another to wan2 How can I make use of the link redundancy here? KB #10376 http://kb.fortinet.com/kb/documentLink.do?externalID=10376 suggests to use ECMP routing to achieve that The problem is that both wan1 and wan2 interfaces have to be in the same subnet to reach the upstream routers, which Fortigate doesn' t allow thanks, HGheist

[ede_pfau]

Hi, and welcome to the forums. As I see it you can' t have both concepts in one circuit: - if you use HSRP with one virtual IP address facing the FGT, then you use only one interface on the FGT. The HSRP cluster presents itself as one device. - if you want to take advantage of 2 WAN interfaces, 2 routers and 2 ISPs, then use ECMP. No need for HSRP then, except for that I' m overlooking something that HSRP does and that you need. Both ways are viable and reasonable solutions. There is a way to allow overlapping subnet addresses on multiple interfaces on a FGT but this creates a huge security risk. It deactivates the anti-spoof feature systemwide. Absolutely recommended against, and unnecessary also.

[#3]

Ede, In other words, to get 2-port upstream redundancy with FGT, i should be using ECMP and the upstream routers cannot be in the same subnet for that Thanks, HG

[emnoc]

Confusion: if this is HSRP is this not being done via the two upstream routers and aren' t these routers " cisco" ? If this is true, all you need todo is plug the 2 wan lan interfaces into a shared hub/switch and the fortigate into that switch as well. The redundant operation is then performed via the cisco routers.

[#5]

Emnoc, What I would like to accomplish is failover in case of upstream router failure and failover in case of wan1/wan2 interface failure. The use of one shared hub/switch kind of defies the redundancy requirement - it becomes the single point of failure Understand I can use one port only and have two routers upstream connected to it, presenting themselves as a single virtual IP. With Cisco or Linux, i could have created a trunk out of wan1 and wan2, but alas, doesn' t appear to be possible with FGTT. Per Ede' s suggestion, I' ll look into ECMP, with two upstream routers being in different subnets.

[ede_pfau]

That' s right. You can choose the transfer networks (the IPs of the 2 WAN routers and of the 2 FGT WAN ports) freely as long as the two don' t overlap. Did you have a look at the ECMP feature yet?

[#7]

I have, however i need to ask the upstream colo provider to change the setup on their side I guess, the way to deal with it with Cisco/Linux is to have an upstream trunk made out of wan1 and wan2 HG

[emnoc]

heilige Another option is to use GLBP on the cisco. This would place the ECMP function within the hands of the cisco and nothing would have to change out side of having one WAN to the common lan-subnet that the cisco sits in. With GLBP vrs HSRP, you get true active/active to include weighted load balancing for non-symmetrical links. i.e with a 4 to 1 balancing alogrithim, 4 packets out router1 vrs 1 out router2 Check with your ISP provider and see if they support this.