Experience with Fortigate HA and HP Procurve switches?

[Carl_Wallmark]

Hi, I have 2 FG 200A set up in a HA and with alot of VLANS, Does anyone have any experience with HP Procurve (2600) switches and trunking between FG and Switches, i´m having a bit problem with how to configure trunking on the switch, its working when i have Trunk1 to one of my FG and Trunk2 to the other but not when Trunk1 is connected to both. Is there anyone who have a working setup like this ??

[UkWizard]

ensure you are using 802.1q trunking method and that the trunked port to the fortinet is configured (tagged) for all the trunks you want to see at the fortinet end. Should work, have not personally done it with procurves though, but doubt its undoable.

[Carl_Wallmark]

my setup is like this: FG1 -----Trunk1-----> HP Switch | -- HA Cluster FG2 -----Trunk2-----> Same HP Switch This way it works, but if a do like this: FG1 -----Trunk1-----> HP Switch | -- HA Cluster FG2 -----Trunk1-----> Same HP Switch Then it fails. Should i use Spanning Tree ?? (STP, RSTP, MSTP) Thanks!

[doshbass]

Actually, from the description, I would have expected scenario 1 not to work and scenario 2 to work. In an HA environment, you should not have to setup spanning tree Can you be more precise about what exactly fails? Fortinet and ProCurve are strategically alligned, therefore you should be able to get help from either procurve or Fortinet support for the entire issue. Having sid that the alliance is only about 6 months old, so they may be catching up with each other' s products.

[UkWizard]

I agree with doshbass, i would of expected the latter to work. However, what mode is the cluster in? as this would probably affect the setup.

[Carl_Wallmark]

i will loose contact with my cluster if a use scenario 2, i seems like the procurve switch gets confused. If i turn off one of the FG´s it starts to work again. So my solution was to make 2 different trunk ports instead of 1. But i dont think the load balance will work because the switch is only using one of the trunk ports, and holding the other port in " stand by" mode. so thats why i wondered if someone had som experience with HP Procurve switches =)

[Carl_Wallmark]

right now i´m using Active-Passive, only because load balancing is not working as i expected, but i would like to run in Active-Active mode.

[UkWizard]

Sounds like you have spanning tree on, turn it off. If i remember correctly the two units would share the same IP and virtual MAC, thus STP would break this.

[Carl_Wallmark]

how will the procurve switch handle the same MAC on two different ports ?? Will it not get confused ??

[doshbass]

The MAC jumps from old master to new master so will not appear on two switches. However if you turn on spanning tree on teh switches one switch will effectivly block teh Master from seeing its slave