Full Mesh HA with 802.3ad Interfaces and VLAN Tagging

[efuhrmann_ip]

Hello,

I'm attempting to deploy a (full) mesh HA configuration [Active-Passive] and leverage 802.3ad/LACP in place of redundant interfaces.  The Fortinet overview references either 802.3ad or redundant interfaces can be used, however, the example only references redundant interfaces.  http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-high-availability/HA_full_meshExample...

Has anyone deployed a setup similar to mine with aggregates?

Additional reading suggests VSS may be required on the switches, however, our switches do not support it.  Does this leave me limited to using redundant interfaces and Active-Active mode?

Thanks for looking!

[Toshi_Esumi]

We never tried the "full-mesh" as in the online help example but almost always use aggregated interface with LACP w/ a-p HA for larger installations as long as the FGT model allows.

Based on the example and your diagram, I have a couple things to concern.

- If those stacked switches are just passing vlan 10, 20 and 30, it has nothing to do with VRRP. Because the GW IPs are on the FGT.

- Then the biggest question is how to have  multiple paths between a FGT and the server. I never tested FGT's spanning-tree handling capability before when both paths are supposed to be up.

- If you're thinking "redundant" interface as in the example instead, I'm not sure if it's possible with aggregated interfaces.

For the 2nd and 3rd points, wait for somebody else's comments.

What we do instead is basically we have just one stack of switches, or a route-switch with multiple GigE blades, and one leg of agg-int goes one switch (blade) and another leg goes to another switch (blade) so when one switch (blade) dies, it can still operate with a half of the bandwidth until we replace the bad one. With this way, we don't have to worry about spanning-tree problems so we don't have to use redundant interfaces. 

[efuhrmann_ip]

Thank you for the responses.  I have details below.

toshiesumi wrote:

We never tried the "full-mesh" as in the online help example but almost always use aggregated interface with LACP w/ a-p HA for larger installations as long as the FGT model allows.

Based on the example and your diagram, I have a couple things to concern.

<snip>

What we do instead is basically we have just one stack of switches, or a route-switch with multiple GigE blades, and one leg of agg-int goes one switch (blade) and another leg goes to another switch (blade) so when one switch (blade) dies, it can still operate with a half of the bandwidth until we replace the bad one. With this way, we don't have to worry about spanning-tree problems so we don't have to use redundant interfaces. 

We are using the switches for L3 of other networks/VLAN's that don't traverse the firewall/zones.

From everything I have read, I believe there are two scenarios for a full mesh:

1) FGT with 802.3ad to a single stack

2) FGT with redundant interfaces to a dual+ stack

azh wrote:

Hello, 

As your switches support VRRP  they  are probably should be - L3 switch. If so, you can use dynamic/static routing and avoid STP troubles. 

Yes - we're looking to get some additional switches to test prior to rolling out in Production.  OSFP may resolve our issues so we can deploy according to the diagram.

FGT with 802.3ad to dual switching stacks.