Help needed with FG 100F - HA - A-P behind VRRP routers

[Seferian]

Hai all. After reading a lot on these forums helping me on the way with Fortinet producs, I have a problem that might be really simple but I don't see it. We have 2 FG100F in HA A-P running behind two Cisco routers in VRRP (ISP routers). I have configured the WAN1 interface with the IP's provided. So far so good. HA works fine when I pull the WAN interface on the main FG. However when the active VRRP router fails the WAN does not go down so no failover occurs. This mean no redundancy. 

What is the best way to setup the FG's to the VRRP routers? I've used SD-WAN in other locations where we have redundant ISP's. That works like a charm. However for this main location we have 1 ISP with a redundant 200mb's line.

At the moment the setup is:

Router A      VRRP       Router B

    |                                |

FG100 A ===HA=== FG100 B

I need to find a way to connect both FG's to both Routers while keeping the IP information and Gateway the same. 

Hopefully you can help me out. 

[jorge_americo]

are you using VLAN ? or interface untagged?

[Seferian]

jorge.americo wrote:

are you using VLAN ? or interface untagged?

These interfaces are untagged. 

[jorge_americo]

Seferian wrote:

jorge.americo wrote:

are you using VLAN ? or interface untagged?

These interfaces are untagged. 

I believe that if you do the configuration with VLAN you will not have this problem, as there will be knowledge of the L2 path, even if FGT_A is active and Router_B is with VRRP active.

Router A ========= Router B    |                                      | FG100 A === HA === FG100 B

Or you can also try to understand the reason why the VRRP is being changed, without dropping the interface.

[Seferian]

jorge.americo wrote:

Seferian wrote:

jorge.americo wrote:

are you using VLAN ? or interface untagged?

These interfaces are untagged. 

I believe that if you do the configuration with VLAN you will not have this problem, as there will be knowledge of the L2 path, even if FGT_A is active and Router_B is with VRRP active.

Router A ========= Router B  |                                      | FG100 A === HA === FG100 B

Or you can also try to understand the reason why the VRRP is being changed, without dropping the interface.

I'm not quite sure I understand what you're trying to tell me. The Routers A and B are off the ISP. Let's assume the config can't be changed. And it's in VLAN0. How would I need to wire my fortigates to these devices? At the moment Fortigate A has a cable from WAN1 to RouterA. And Fortigate B has a cable from WAN1 to RouterB. 

When I pull the cable on FG A it will failover as expected. However if I pull power from RouterA the Fortigate does not failover. My guess is because RouterB does not have a cable to Fortigate A. So RouterB became active but does not have a direct path to Fortigate A. Only to Fortigate B. 

Is there a way to let the Fortigate failover when, let's say, it can't ping 8.8.8.8 five times in a row. If I then pull RouterA, Router B would become active. Fortigate A would not be able to ping 8.8.8.8 and should failover to Fortigate B. Then the connection should be active again.

But I'm not sure if the is the way. And if so, how to configure this.

[Toshi_Esumi]

I think you need a switch inbetween. VRRPs (per interface, not per device) between two routers would be half-useless if devices, in your case FGTs, are physically connected to only one side. When that side of hardware dies, the devices connected to it lose the path.

[jorge_americo]

Sorry, but in the case described. if you turn ROUTER_A off the FGT_A interface will be DOWN, ok? . and thus force HA (if the interface is being monitored)

As for testing with ping for switching, I don't know.

[Seferian]

toshiesumi wrote:

I think you need a switch inbetween. VRRPs (per interface, not per device) between two routers would be half-useless if devices, in your case FGTs, are physically connected to only one side. When that side of hardware dies, the devices connected to it lose the path.

I was thinking of creating a hardware switch on the Fortigate. Put two interfaces in it and configure it to be the WAN. One interface will be connected to RouterA and the other to RouterB. This will be done on both Fortigates. 

Would this work? And is there a downside to using a hardware switch over a physical interface?