HA Cluster with 3 WAN, 3 Lan and Layer 3 Switches

[#1]

Hello, We have just started to install 2 Fortigate 620B and 1 FortiAnalyzer 100C to our existing system. Right now our network details are as follows; - 3 WAN Connection, - 3 Interrnal Lan VLAN and - Juniper ex4200 switches (virtual chassis) in the system room. We want to operate our 620B' s as A-A HA cluster and we are trying to figure out how to do ... We made the related configurations and settings for our master device. Right now we want to figure out correct cabling. Currently our master device is up and running. Cables from WAN devices and VLAN ports of juniper' s connected to our master. But we want to add the orher device and configure them as intended. Let me ask if my assumption is correct; - Connect two port of the both 620B devices with each other (and setup), - Connect two cable from let' s say ADSL modem to both of the 620B' s, -- Can we use ADSL modem' s ports for this cabling ? -- Or do we have to use a seperate hub/switch for cabling ? -- Can we use special VLAN' s for this WAN connection in juniper ? -- Port trunking ? - Apply the same method for other WAN and LAN ports ... Here we go, do i need a seperate switch for each connection for my ha cluster ? Or can i use juniper for atleast VLAN' s ? It would be great if someone can guide me on this issue. Thanks

[willem]

Hi Erdembey, welcome to the Fortinet community. I' m not totally sure if I understood your questions correctly, but I can already tell you that VLAN' s are no issue. The FortiGate understands 802.1Q trunking without any problem. If you create a VLAN-interface under a physical port of the FortiGate, 802.1Q is enabled automatically. About the clustering: what I always do is backup the config of the first device and restore it to the second one. Afterwards I just change the hostname and HA priority of the second device and connect them to each other.

[jroy777]

Sounds like a great Idea and simple. Will I be able to have redundancy on the Vlan's and separate circuits on the "WAN" side? The 2 switches are 424E's and we want to use BGP at layer 3 to two differents paths to two different AWS Direct Connect regions. 

[ede_pfau]

Hi, and welcome to the Forums! The requirement for the cluster is to have one broadcast domain for each connection, that is 3 ports: fg1, fg2 and the network connection. I' ve always used separate switches for each connection, mainly for ' internal' , ' DMZ' and ' WAN' . In theory you could use just one switch for all ports which you partition into VLANs and VLAN groups. The point to observe is that for each VLAN the switch must provide a MAC table of its own as the MAC addresses of both Fortigates will be the same for both cluster members. I tell you it' s not easy to find out from the specs whether a particular switch model supports this. Of course you can use the internal Juniper switch (cluster) to connect all firewall internal ports together, so no need for a separate internal switch here. For WAN you could use a 12port or even a fanless 8port switch of its own. I' d never rely on the crappy switches they incorporate into modems/routers. Besides, booting the router would heavyly disturb the cluster. It really doesn' t matter if you run more than one VLAN over one cable; the FGs use VLAN tagging anyway, and simply defining multiple VLANs on one physical port will create a VLAN trunk. And for ruggedness use one simple TP cable to connect the HA ports together.

[#5]

Hello Willem and Ede, Thank you for your replys. Willem, I will use the method you provided to configure my slave device. Thanks. Ede, so can i say that i can use a separate switch which has vlan capability for my wan connections. For ex. for my 3 wan connection i will use a 24 port vlan switch. In that switch port 1,2 and 3 will be vlan 100 for my adsl and port 1 will be connected to adsl router, the other 2 port will be connected to my 620B' s. In the same witch port 4,5 and 6 will be vlan 200 for my g. connection and port 4 will be connected to g. router, the other 2 port will be connected to my 620B' s. Same applies for my other wan connection. Same setup for my LAN with different switch and similiar vlan configurations ? To sum up; - two cable between fg for ha link, - two additional switches, -- one for wan connections, -- one for lan connections. Is that correct ? Or should i use several 8 port switches for all of my ports ? 6 in my examples ? Thanks.

[ede_pfau]

It' s really not complicated at all. Just think of how you would connect 1 firewall to your WAN equipment, and then add one more cable to the second firewall. For 3 WAN lines and 2 FG' s you would need 5 ports: - port1: to ADSL modem - port2: to " g. connection" (UMTS?) - port3: to yawc (yet another wan connection) - port4: FG1 - port5: FG2 So a fanless 8port switch will do. I don' t see why you would have to use VLANs for your WAN connections. They are point-to-point links and not much broadcasts involved, nor security issues. But you can assess that yourself better than I can. And for your connections to the LAN it' s even simpler: - one cable from each FG to the internal switch cluster, carrying all VLANs. So, depending on space and distances, you might not even need a separate switch.

- two cable between fg for ha link

why? one link, one cable. Never pull it, though. Beware that connecting the slave device will lead to a cluster reboot. I def. recommend reading the HA Guide by heart.

[#7]

Thank you. I will try and update this thread in case i can' t solve the issue.

[#8]

After working on the related configurations for about several hours, i couldn' t accomplish the configuration as it' s intended ... We' ve made the required configurations on the one of the devices. We' ve installed a 24 port AT switch with 6 seperate vlan configuration for our HA. The problem is that it seems 10/100 device :( Anyway we' ve created 3 ports per VLAN. 1 for source and the other two is for our 620B' s. So; - Vlan 110 -- ADSL -- FG1 -- FG2 - Vlan 120 -- Subnet 1 -- FG1 -- FG2 - And so on ... 1) Our ha configuration supposed to be active-active and operation mode is set to NAT. Is it correct ? Should i use transperant ? What is the difference ? 2) Port 19 and 20 configured as heartbeat interface, enabled, 50 as priority. Directly connected via two cable between devices. Cross required ? 3) None of the port monitors enabled ? Lol there should be atleast one isn' t it ? 4) Device priority is the same ... As it is A-A ? 5) Enable Session Pick-up not selected. 6) Port 1, 2, 3, 16, 17 and 18 are active for our internal and external requirements. 7) My switch for HA configuration is 10/100 will it performance problem ? It is AT-750/24 from allied telesis. When i use cables directly from that switch my ports on the fortigates led colors changes from green-green to green-red. 8) From the HA point of view is it possible to use direct cables from vlan assigned ports of my switch in backbone ? I suspect session continuity and such. Should i define link aggr. on juniper so i can use that related two cable from switch to my FG' s without any other switch in the design ? There are several different vlan enabled ports on my backbone switch. 9) Is my configuration correct ? :) 10) Is it possible to change group name and device name in actual HA configuration. I want to change the naming because of the naming problem at the beginning ? Thanks!

[ede_pfau]

Whoa, excuse me for being frank but reading your questions I have serious doubts if it is a good idea to configure the FGs on your own. You should definitely get professional help onsite, from Fortinet or a Fortinet partner. Who sold you the 620B' s without offering configuration? There are so many aspects of your setup that need close inspection...as you see from your 10 point list. IMHO this really is out of bounds for the Forum site. I can give hints and gladly share my experience with Fortigates but cannot build complete configurations here. You miss even basic concepts, where should I start? Sorry if this sounds harsh but there is a limit on what you can expect from a forum question-and-answer situation.

[#10]

Well you are right ... The funny thing is that we are working with the suggestions from professionals and also an experienced support specialist. But our problem is something strange, whatever we are working with all those informations there are several problems in every aspect of our setup. That' s why i am trying to explore and learn the possible leaks in the conf. Thanks :)