HA Fortigate with HA Fortiswitch - is that working?

[mikt]

Hello

has anyone setup a HA FGT (300D in my case) connected to 2 FSW while using Aggregated ports as Fortilink ports?

Whenever i use the interconnect between the Fortiswitches i create a loop - if i not use that ISL - i only see that one switch connected to the active firewall. 

I may miss a point :)

I would appreciate any help as the manual is not very helpfull.

I am running 5.6 and 3.6.2 Firmware 

Thanks!

[sam_hammoud]

Have you set the aggregate ports on the Fortigate you are using to split interface mode?

Commands as follows:

config system interface

edit "Whatever your interface aggregate is"

set fortilink-split-interface enable

[Prab]

mikt wrote:

Hello

has anyone setup a HA FGT (300D in my case) connected to 2 FSW while using Aggregated ports as Fortilink ports?

Whenever i use the interconnect between the Fortiswitches i create a loop - if i not use that ISL - i only see that one switch connected to the active firewall. 

I may miss a point :)

I would appreciate any help as the manual is not very helpfull.

I am running 5.6 and 3.6.2 Firmware 

Thanks!

Hi Mikt,

Yes, I did test the setup of a FG Cluster (active-Passive) connecting to 2 different fortiSwitches.

I did use an aggregate interface as a fortiLink & it worked fine.

Solution:

If a fortiGate/Cluster is connected to two different fortiSwitches via fortiLink, then your MUST use fortiLink-split-interface enabled command. The only exception is to use MCLAG and create an ICL between these fortiSwitches instead of using normal ISL. After that you can disable the fortiLink-split-interface command. ;)

Ref: Page 2142 of the FortiOS Handbook for FortiOS 5.6.2

The following topology was tested in my lab and it worked fine:

I hope it was helpful.

Thanks & regards,

Prab :)