HA between 2 sites

[#1]

Hi there. We have the following scenario. We have two sites (A and B) conected thru a dedicated line (100mb) by our communications provider. We have two fortigate 300A in each sites. Both side are connected to the same subnet 172.20.0.0/16. All the servers are in site A in subnet 172.19.1.0/24 All the DMZ is in the site A in subnet 10.0.0.0/24 The clients are in site A or B in subnet 172.20.0.0/16 We want to make the site B backup of the site A. We must have a subnet 172.19.1.0/24 and 10.0.0.0/24 in site B with replication. What we want is that in case the link between site fails or one site fails, the other site can work. How we can configure the 2 Fortigate to have the same subnet 172.19.1.0/24 and the 10.0.0.0/24 in the two site. Any ideas... Thank you very much for your help

[Georges_Nassif]

Hi, I think you should connect the internal interfaces in the two sites to the same vlan the same for the dmz to another vlan, and also for the HA interfaces in both fortigates but for sure the link between the 2 sites msut allow this , it must be a trunk. Hope this will help

[#3]

Thank you for you answer, But i can' t use HA between two fortigate in two different sites. I read that they must be connected to the same physical swith. If someone have experience into the impletation of HA between different sites ? I really appreciate.

[p768]

they do not need to be connected to the same physical switch, just the same vlan.

[Georges_Nassif]

Yes, the 2 interfaces must be in the same broadcast domain (ie same vlan) and i already did this setup multiple times

[#6]

Use OSPF to redistribute routes. We have a DC and DR site connected with 90megabits. Each site has an ISP and MPLS link. If the DC ISP dies we use a ping server to detect and flip the default route to the DR site. We propagate all our routes between sites and via BGP into our MPLS network. The MPLS network see 2 routes to the DC, one from the DC and another from the DR site. So if the DC mpls fails another route through the DR is available. Works great and failover is pretty fast, 1 - 5 dropped packets.

[#7]

Thank you for all your answers, But i have a question about the connection between the 2 sites. Today they ar connected with 2 switchs cisco 2970 and there are in the same vlan (vlan1 by default). Can i connect the 2 sites with the 2 fortinet and in this case can i use the HA interface? Or i must connect all my vlans (and attribute ports to each vlan) to the 2970 in each site and etablish a trunk link between the 2 switchs? Thank you for you help ..

[#8]

Please, Someone has a response to my question about the inter-connexion between 2 fortigate in HA located in 2 differents sites. Thank you

[#9]

The HA interface is meant for a direct connection between two firewall. The amount of traffic is not reasonable for sending across a small WAN circuit. the best design is to use dynamic link-state routing to handle the failover over. In my case i used a ping server to detect ISP failure. then i utilized OSPF routes to get my traffic between the primary and secondary sites. i also use my fortigate, at both sites, to learn my MPLS BGP routes so it sees routes from the secondary site as a higher cost alternative path. these fortigates are in a datacenter and most access comes from the MPLS network. in general failover routing should be accomplished by routers and routing protocols, that' s what they were designed to do. let the firewall filter packets, let the routers decide where they go. keeping that in mind will make the design more straightforward.