HA - Active / Active (priority routes)

[ggntt]

Hi all Is it possible to have 2 units in a cluster in active / active. But have 1 unit act as the primary internet access device over service provider A Have the second unit act as the primary IPSEC VPN device to a remote site over service provider B (possible to specify the preferred route so to speak) In the event of either service provider failure can the second device in the cluster take over that role automatically ? Thanks greg

[ede_pfau]

Yes and no. No because an a-a cluster is treated as ONE device in all respects. You cannot offload certain tasks to one of the members alone. Both cluster members are identical and the " cluster device" which is formed from both member devices is an exact copy of each member. Yes because you can configure dual WAN access for the cluster, with automatic failover. If you want you can create Policy Routes for traffic which you want to be handled by the second ISP only. Of course, both ISPs / both WAN lines will be connected to the cluster permanently, to both member Fortigates. You might have a look at the documentation to get a picture of the underlying concepts (FortiOS Handbook - chapter on HA, Administration for v5.2 - virtual WAN link).

[ggntt]

Ede thank you very much for your clear explanation. While both FG’s are on the same campus they are in different comms rooms. So as I understand it, for HA we would have to present both WAN providers in both locations (we could do that over fibre on L2 VLAN’s) We could also do that for the internal network. However I get the feeling that the heartbeat interface might not work in that scenario.. is that the case ? (Seems like its bandwidth hungry and latency sensitive, would that need a dedicated L2 fibre connection or would a dedicated VLAN suffice… (We have limited fibre connectivity) Are there any other options that you know of available for us ? For example We could leave both FG’s in standalone mode and configure a mesh so to speak So FG1 is the primary internet access device on WAN provider 1 (configured with a VPN connection also but not used as the primary) FG2 is configured as the primary VPN device on WAN provider 2 (configured as the backup internet access device) The issue is we need a single default gateway internally (just like how HA operates) – is it possible to have this function ? (similar to how I understood HSRP with Cisco) So should the VPN connection to the remote site fail the redundant VPN connection on the second device becomes active and similarly for the internet connection. (We are not too fussed about dropping a few packets and sessions having to re-establish so to speak but we dont want manual intervention) thanks G

[ede_pfau]

Well of course you could get by with e.g. VRRP, with an ' external cluster' so to speak. That' s just for failover of the FGT' s function. Route failover could be done independently on both devices (with a backup default route and health monitoring) but this might turn out clumsy. If your only concern is the latency on the HA link then I' d suggest you try it out. I would not expect that latency on a fibre would matter. Latency on a VLAN depends on the muscles of your switches. AFAIR there is no documented upper limit to the latency on a HA link but surely with session load the time to keep up with status information will become shorter and shorter. I' d recommend working on a real cluster scenario and trying to tackle the latency question. Open a call with TAC, or directly ask your Fortinet SE for support. It' s not only about dropping a few sessions but config sync as well. In the end 2 systems are much more work to maintain, adjust and troubleshoot than one.

[ggntt]

Thanks Ede All makes sense. Configured the HA cluster here in the lab...looks like the way to go tbh. greg

[norouzi]

Another way is using HA in Active-Passive mode when you have VDOM enabled.

One VDOM for every link.

So you can use virtual clustring.One VDOM is enable on each device.

Plaese look at HA configuration Clustring Mode.