HA Active-Active and Asymmetric Routing

[Infrarium]

Hello everyone,

I have two fortigate units in standalone mode and both have asymmetric routing enabled. I would like to re-design my network in order to not enable asymmetric routing since enabling it is a (very) bad security practice.

So, here is the diagram of the network. The fortigates are not in cluster.  What happens is that L3 switches load balance the traffic that originates behind them in a round-robin fashion using wan link 1 and wan link 2. Traffic may go using wan link 1 and come back using the other wan link. In order to overcome this, we enabled asymmetric routing (long back ago) and its working since then, no issues. Today we want to re-design the network to avoid the use of asymmetric routing since its a bad security practice.

I came with several designs, but in every  one of them i have my doubts:

1st design: Active-Pasive cluster, both wan links enter the same fortigate unit so no asym routing enabled. The problem with this is that the master FG unit fails, both wan links fail and i have to go and manually change the cables to the slave FG.

2nd design: Active-Pasive cluster, sames as before, but with one wan link in each FG unit. The problem with this is that im wasting a whole wan link, and i MUST use both at the same time.

3rd design: Active-Active cluster, but here i have even more doubts, because i do not have real world experience with active active clusters and i dont see how it can address the asymmetric routing problem.

Any help would be appreciated, thank you in advance!

[gfleming]

Please review the High Availability information in the FortiGate documentation it has lots of good info: https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/666376/high-availability

You have some misconceptions about how it works and I will summarize for you:

1. A-P Cluster, both FGT units will have wan1 and wan2 connected. If FGT1 fails, FGT2 takes over automatically and there is no break in connectivity. The FGT uses a virtual MAC address to ensure IP connectivity over either FGT.

2. A-P cluster cannot operate in this fashion. Please review the "Critical Cluster Components" on this page: https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/62403/fgcp (you need identical interfaces on both units)

3. A-A is really only used to offload security processing to two or more units. All regular traffic will still traverse the primary gate.

In your situation I would highly doubt you actually need A-A set up in any way. A-P should suffice just fine. Review the FGCP A-P documentation and you will see it's not hard to set up and get going.

[Infrarium]

Thanks for the fast answer!

Yes, i should try to set up a AP cluster, the only thing that still remains is that both wan links end in the same FG unit, and i must use both of them simultaneosly, so i need to put a switch in between the FG units and the L3 switches so traffic can flow to the slave FG in the case that the primary fails.

[gfleming]

You already have switches according to your diagram. Assuming you have free ports in those switches you can use those for the WAN links. You would need three ports per WAN link (one for the WAN link, one for each FGT connection). 

[Infrarium]

Yes, but i can only do that on one side of the diagram, because the other L3 switch is physically separated, so the only thing that i have on that side are the two fiber cables of the WAN link.

[pminarik]

Standard A-P/A-A FGCP cluster design assumes that a link is connected from a switch to both units, e.g. Switch connects the ISP1 link to both FGT1 and FGT2, and also connects ISP2 to both FGT1 and FGT2. Same with downstream links. The failover happens on layer2 by the cluster MACs moving from one FGT to the other (GARP, or link flap).

Can you find two additional ports on the L3 switches to wire things up like this standard FGCP design? If not, what's blocking you from doing so?

[Infrarium]

I can do what you say but only on one side of the diagram, the other L3 switch is physically separated from the FG units and I only have one fiber cable for each WAN link, no switch in the middle. 

What i can do is get a switch to put in the middle, but if its a single switch then i have a single point of failure and thats a thing that i dont really want to add to my network topology.

[pminarik]

You could try doing it with a hard-switch, similarly as shown in the document here - https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/931221/configuring-sd-wan-in-an-ha-clust... , but that setup is still sub-optimal. If the Unit with the physical connection to ISP-X goes fully down, the other unit won't have access to that ISP-X. There is no way around this bottleneck without having ISP-X linked to both FortiGates.

[gfleming · Accepted solution]

You can invest in two small 8-port switches for each WAN link. Not a heavy invesetment. And now you have full HA redundancy in a sound design.

[Infrarium]

I thank you for the fast responses and all the documentation and help you have provided me on this matter. Seeing the HA documentation of Fortigate units I saw this:

https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/668583/fgsp

Could FGSP be useful in this case? The documentation says that: "FGSP is primarily used instead of FGCP when external load balancers are part of the topology, and they are responsible for distributing traffic amongst the downstream FortiGates."

Since my topology consist of two L3 switches that load balance the traffic between the wan links, could this be a case where FGSP is the best option (instead of a FGCP cluster)?