Fortigate Firewall setup

[capricorn80]

 Hi!

I have attached rough sketch of my network topology. We have core switch pointing to Fortigate for internet and then we have access switches where servers or users ports are connected.

We have two fiber from ISP with primary and backup link and that is terminating direct to fortigate (As per plan) but I cant find how I can terminate that on two Firewalls

So we will run Active/Passive and then we have SVI in core router. The core router has a default route to 10.1.1.1 which is on Primary firewall. If the Primary goes down then how will the default gateway will be updated? Thinking like HSRP or VRRP in this case but not sure.

Need to suggestion on this.

I have attached the picture.

Thanks

[rwpatterson]

You will need to put a switch in there that will allow the fiber termination to be split between both devices. Both Fortigate units will display the same IP and MAC info and when one fails the second will take over as though nothing went wrong.

[capricorn80]

Thanks.

So all I have to do is to cable the secondry Firewall and the primary will share its config with it including interfaces. Its little different. I will try to simulate this as well so get better picture.

Coming back to my topology. I was reading few articles and also missed to mentioned that I have kind of same topoloy

http://www.madari.co.il/2016/08/hpe-flexfabric-irf-with-fortigate-ha.html

Where we have core switch running IRF and then we have access switch connected to it. I am attaching the new pic.

[capricorn80]

Hello guys!

Can anyone validate this?

If this is the right way to use Fortigate 100E.

Also if someone can give me example of how the Fortigate should be configured with Link Aggregation.

Should I create Active-Passive cluster first and then create Link aggregation?

Thanks