FortiGate 901G HA Cluster with Cisco Switch Stack Using LACP – Best Practice Configuration

[noc_92]

I am looking for a best-practice and supported configuration for setting up two FortiGate 901G devices in an HA cluster and connecting them to a Cisco switch stack/cluster using LACP.

Environment Details:

• FortiGate model: 901G (2 units)

• HA mode: Not decided yet (Active-Passive or Active-Active)

• Switching environment: Cisco switch stack / clustered switches

• Link aggregation: LACP (802.3ad)

Objective:

• High availability at the firewall level

• Redundant and aggregated uplinks to the Cisco switch stack

• Stable and supported HA + LACP design

• Avoid split-brain, MAC flapping, or failover issues

Questions:

1. What is the recommended Fortinet-supported topology for FortiGate 901G HA when using LACP to Cisco switch stacks?

2. Should LACP be configured using a FortiGate aggregate interface, and should it be created before or after HA is enabled?

3. Is Active-Passive HA preferred over Active-Active when using LACP with Cisco switch stacks?

4. How should the Cisco side be configured (single port-channel across stack members, trunk mode, LACP active)?

5. Are there any specific FortiOS settings or limitations for HA + LACP that I should be aware of?

6. Are there any official Fortinet documentation or reference designs for this setup?

I would appreciate guidance from Fortinet engineers or experienced community members, including recommended topology, CLI examples, or documentation references.

Thank you in advance for your support.

FortiGate 

[AEK · Accepted solution]

• The following tech tip answers most of your questions (Q1, 4, 5 and 6): https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-setup-LACP-between-FortiGate-and-Ci...
• For Q2, it doesn't matter if you create it before or after enabling HA.
• For Q3, it is the same configuration for A-A HA and A-P HA, and there should be no preference when it come to LACP

[AEK · Accepted solution]

• The following tech tip answers most of your questions (Q1, 4, 5 and 6): https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-setup-LACP-between-FortiGate-and-Ci...
• For Q2, it doesn't matter if you create it before or after enabling HA.
• For Q3, it is the same configuration for A-A HA and A-P HA, and there should be no preference when it come to LACP

[Toshi_Esumi · Accepted solution]

The topology is as in the KB @AEK pointed you to, but only difference is in your case those cisco switches are stacked, which make them as a single switch. Therefore, all four ports in the KB example, need to have a different number each. Of course, you want to split two legs of a LAG/Port-channel to each physical switch.
The bottom line is, unlike cisco, FGT doesn't support LAG without LACP. You have to configure LACP on both sides.

L1/L2 come up even when the unit is a secondary/passive in a-p, and act as a single link. You would hook up and single link any time regardless both are separated or in HA, wouldn't you?
And, again, LACP is just a link, it wouldn't affect any HA operation, regardless it's a-p or a-a.

Toshi

[AEK]

Didn't notice the stack.

Thanks for correcting, Toshi.

[noc_92]

Thank you both @AEK  and @Toshi_Esumi  for the clear explanations and guidance.

The shared KB and your clarifications answered all my questions, especially around HA independence from LACP, Cisco stack behavior, and the requirement to use LACP on both sides. The note about splitting LAG members across stack units and FortiGate not supporting non-LACP LAGs was particularly helpful.

Really appreciate you taking the time to respond and correct the details — this helps a lot in finalizing a clean and supported design.

Thanks again for the support 

[sw2090]

Keep in mind that if you configure the FGT to be active-passive you will need LAGs because both nodes share the mac addresses! 

I myself here had to learn that the hard way...