Hi everyone,
I'm relatively new to networking and eager to learn.I would appreciate your input regarding a technical solution. Specifically, in the following architecture, I aim to facilitate communication between zones using two firewalls configured in High Availability (HA) active-passive mode. The challenge lies in achieving complete redundancy without employing intermediate switches between servers and firewalls.
In the scenario where, for instance, FG1 is the active firewall and the connection between SRV1 and FG1 drops for a specific reason, I'm unsure how to achieve full redundancy without using intermediate switches. In such cases, the only solution seems to be manually forcing an HA failover.
I'm thinking about using HA active-active, but I haven't used FortiGate devices in this mode before, and I'm uncertain if it's the optimal solution. I understand that having a pair of switches between servers and firewalls is preferable, but due to space and cost constraints, I'm considering this approach as a last resort.
I would greatly appreciate any insights or recommendations from the community on this matter. Thank you for your support.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi Nethori
I've never thought of such design but I think there might be some useful ideas.
Once all this done, you need to test all possible scenarios before go prod.
Hi Nethori
I've never thought of such design but I think there might be some useful ideas.
Once all this done, you need to test all possible scenarios before go prod.
I don't believe you can achieve complete redundancy without some switches in place. Ideally, you should have a switch stack with connections distributed evenly across them so the system could copy with firewall, switch and NIC failures. At the very least, you'll need a single intermediate switch.
I presume that you have an internet service coming into your FG-100F. How will this fail over without a switch?
My suggestion would be to find a way to get a switch in there.
If you're thinking to use the "hard switch" or "Soft switch" function to accomplish a combined Firewall+Switch hardware stack, I recommend "Abandon all hope ye who enter here"
For example, even if you could Trunk a Dot1Q link between the chassis, you couldn't maintain a spanning tree instance on the soft switch or hard switch. to support NIC teaming by extending a bridge domain (VLAN) across the chassis, it seems, even if the chassis are active-standby or active-active.
I recently made inquiries here and on Cisco's forums related to FirePower product family, and neither vendor are implementing this.
Closest thig would still be a Cisco ASR9K or Cisco ISR4K with a Catalyst Switch Module, but then you're not running a stateful inspection engine.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.