Fortigate freezes when Wan 1 and Wan 2 are connected

[talkwithphil]

Hi, An interesting problem I have encountered when attempting an implementation of the Fortigate 800C last night. Really hoping I can get some assistance here. I have a Fortigate 800C inline in transparent mode between 2 Cisco core switches and 2 cisco asa firewalls. the core switches and firewalls are set up as primary/secondary(failover). We put the Fortigate in between these devices in transparent mode, primary core switch to wan 1, port 1 to the primary firewall. secondary core switch to port 2, wan 2 to secondary firewall. Policy was set as Port 1 -> Wan 1 any any all and Port 2 -> wan 2 any any all When we made connections for port 1 and wan 1, everything worked fine, internet connectivity worked fine. When we made our connections for port 2 and wan 2, after a few seconds the device started blinking red and essentially shut itself down into bypass mode. management console even from usb stopped working and the only way to get it out of this mode was to remove the port 2 and wan 2 connection. I am not sure why this is happening! Help!

[Chura]

I believe you caused some kind of loop on the system, so more traffic then it can handle. The only way to look at it will require ' diagnose sniffer packet' while you make the bad connection. it will probably die on you again but you will see what network looped or something.

[netmin]

Maybe this helps in troubleshooting: http://kb.fortinet.com/kb/viewAttachment.do?attachID=Fortigate_Transparent_Mode_Technical_Guide_FortiOS_4_0_version1.2.pdf&documentID=FD33113 If the ASAs are running A/A, this could be checked as well: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/ha_active_active.html

To avoid having duplicate MAC addresses on your network, make sure you assign each physical interface a virtual active and standby MAC address.

[talkwithphil]

I spoke to Fortinet Technical support about this issue and was told the following. In transparent mode, trying to use two use both wans will not work because you cannot set priority on the routing table therefore, both port1/wan1 and port2/wan2 will fight to take priority and cause the device to fail into bypass mode. Typically in a nat mode implementation, you can create the routing tables and set priority to resolve this issue but those features for whatever reason in transparent mode are not available. From documentation: In transparent operating mode, all physical interfaces act like one interface. The FortiGate unit essentially becomes a bridge — traffic coming in over any interface is broadcast back out over all the interfaces on the FortiGate unit. In transparent mode, there is no entry for routing at the main level of the menu on the web-based manager display as there is in NAT/Route mode. Routing is instead accessed through the network menu option. ----- One potential solution which I am currently reviewing is the possibility of enabling VDOM and creating a VDOM for each of my " zones" to prevent the broadcast from causing a device shutdown. I am not quite sure this will work but will update once i get a firm answer. Cheers and thanks for your reply' s -Phil

[talkwithphil]

So i got a more concrete answer from a fortinet tech, and maybe this sounds like basic knowledge now but here it is. In order to do what I am thinking of doing, in transparent mode, the only way to achieve this is to create two separate vdoms. unfortunately this also means you have to recreate all your policies twice, once per vdom, and there is no way to replicate policies accross each vdom. except for some export/import via cli but that only helps for some of the configuration. Even when I get my second device in for redundancy its not recommended that I HA cluster them because it will necessitate a full mesh setup that is not worth the additional configuration for the size of our network. Needless to say there is no way I can avoid managing two identical sets of policies whether its on one device using VDOM or two separate devices. oh well...on to the next problem

[Dave_Hall]

In order to do what I am thinking of doing, in transparent mode, the only way to achieve this is to create two separate vdoms. unfortunately this also means you have to recreate all your policies twice, once per vdom, and there is no way to replicate policies accross each vdom. except for some export/import via cli but that only helps for some of the configuration

More than one person here will tell you to load a backup of the config into a text editor, copy the relevant sections of the config into a separate text file -- edit the references of this new section, then paste it back into the new vdom location in the original config. (If you plan to do this, I suggest back up the original config then split the fgt into two vdoms and save/use that config.) Edit: it will be more involving setting up the new vdom and getting the interfaces properly matching under old/new sections, so not quite sure what is involved.

[Matthew_Mollenhauer]

An alternative is to take a look at using port-pairs and setting forward-domains, we have an 800C doing transparent inspection on one of our WAN links that is carrying two VLAN' s. As traffic is all vlan tagged we had to create sub-interfaces to see the traffic, however once we did we were seeing traffic from vlan 50 on both vlan 64 routers (at both ends of the WAN)

800C (IPS) # show system port-pair
 config system port-pair
     edit " BB-50" 
         set member " BB-50_north"  " BB-50_south" 
     next
     edit " BB-64" 
         set member " BB-64_north"  " BB-64_south" 
     next
 end
 
 800C (IPS) # show system interface BB-50_north
 config system interface
     edit " BB-50_north" 
         set vdom " IPS" 
         set forward-domain 50
         set interface " port1" 
         set vlanid 50
     next
 end
 
 800C (IPS) # show system interface BB-50_south
 config system interface
     edit " BB-50_south" 
         set vdom " IPS" 
         set forward-domain 50
         set interface " wan1" 
         set vlanid 50
     next
 end
 
 800C (IPS) # show system interface BB-64_north
 config system interface
     edit " BB-64_north" 
         set vdom " IPS" 
         set forward-domain 64
         set interface " port1" 
         set vlanid 64
     next
 end
 
 800C (IPS) # show system interface BB-64_south
 config system interface
     edit " BB-64_south" 
         set vdom " IPS" 
         set forward-domain 64
         set interface " wan1" 
         set vlanid 64
     next
 end
 
 800C (IPS) #

Regards, Matthew Mollenhauer