ECMP for HSRP active/passive internet access?

[jaym222]

Hello In our Datacenter, I have a Verizon circuit/managed router for our primary internet access. I have a Level 3 circuit/managed router for secondary internet access. They are configured with HSRP. Fortigate 300c HA pair(v5.GA Patch5) master/slave internet interfaces and routers terminate in a switch stack. The switch stack needs to be removed temporarily...... Question: Temporarily, can I plug the primary internet router directly into the Master firewall internet port and the secondary internet router into the slave FW and use a combination of ECMP Spillover and HA interface monitoring to automate failover if the primary circuit goes down? If so....what would the ECMP Spillover set up be in this case...I have never used it. Thanks!

[emnoc]

Qs; What are you trying to do or gain by this? Next, if the HA is A-P ,than the slave is not doing anything? Lastly, why don' t you craft a ECMP route and just use the 2 uplinks? if it' s not clear , you would route to the real-address of the 2 provider and not the HSRP VIP.

[Kyle_McKay]

Your upstream providers are running HSRP between them? That is surprising to me.... If that is indeed true, then all of those devices including your FortiGate pair are on the same subnet. In this case, you can definitely just plug directly from your ISP router to each FortiGate. Is this A-A or A-P cluster ? If you remove the switch stack, each provider *should* think it is the " Active" HSRP router on that network; assuming there is no other layer 2 connectivity for the HSRP multicast messages to traverse. This should allow you to use a single route to the HSRP VIP and no matter if the traffic goes through the primary or secondary, traffic will be routed to the virtual IP of the connected Provider router. Just monitor the provider uplinks on the FG cluster and let them handle failover, do not worry about ECMP.

[emnoc]

This should allow you to use a single route to the HSRP VIP and no matter if the traffic goes through the primary or secondary, traffic will be routed to the virtual IP of the connected Provider router. Just monitor the provider uplinks on the FG cluster and let them handle failover, do not worry about ECMP.

I would highly disagree on doing that. Your circumventing the " redundant" part of HSRP and if the provider up-path is broken, you just potentially black-holed your traffic to a primary VIP in that standby-group. Also if you have HA interface monitoring going on, you just damage that part of the FGT-HA. Also, most providers are doing some type of interface and/or protocol traffic to decrement the priority on a up-path failure. If the OP is looking at using both " providers" , than my earlier suggestion of routing to the " real-interfaces" ip_address and not the VIP. This would not require any changes, break any HSRP standby group or anything else as far as that go. Than with ECMP routes on the FGT and dead-gateway detect, you could managed your uplink path So let' s say SP#1 10.10.0.1 SP#2 10.10.0.2 VIP 10.10.0.254 You just apply two equal static routes to 10.10.0.1 and 10.10.0.2 and now you have ECMP between the 2 SPs and no others problems with asymmetrical routing, HA intf-monitor, or disruption of the SP stand-by master/standby relation. I guess you could also add a 3rd route to the VIP ( 10.10.0.254 ) , it would do some strange things with weighting traffic loads 2 to router 1 ( 10.10.0.1 and 10.10.0.254 ) 1 to router 2 ( 10.10.0.2 ) YMMV play around and see what it does and if it achieves what you want.

[jaym222]

Thanks for all the info and feedback! Very helpful.