OSPF in HA

[bdkey]

We were hoping to leverage the OSPF capabilities between our Cisco Nexus Switches and the Fortigate in an Active-Active or an Active-Passive setup but we have run in to issues.

With the Nexus platform of switches, we have two ways to make a connection to devices:

An interface vlan, which creates a distinct vlan on each of the individually managed switches by utilizing Virtual Port Channel technology  to give each vlan on each switch its own ip address and a shared HSRP IP address. This works fine, but due to the nature of VPC and the manner in how OSPF uses the actual interface IP address, we have run into a VPC peering issue which does not allow Layer 3 routing information to route correctly over the platform. Because of this we can only set up static routes between the dual redundant Fortigate units and the pair of Cisco Nexus.

We also have the option of running layer 3 ports from each of the Cisco Nexus units individually. This would require each of the switches to have a unique layer 3 address on the port that connects to the Fortigates. In our research, we have only found examples of Fortigates utilizing a shared address. 

Is it possible to have a distinct IP address on the internal network ports of the Fortigates when using HA? 

Attached is a diagram of what we are attempting to do.

Thanks!

[lord_amarant]

if you want to use ospf i think you woul give a chance at FGSP.

http://kb.fortinet.com/kb/documentLink.do?externalID=FD36472

[Benoit_Rech_FTNT]

Hello,

On the Fortigate, the IP address is shared between the master and the slave device. So, only one FGT is used at a time.

A common deployment is to have each FGT connected to the two Nexus devices. In case of HA failover, the second Fortigate will take over.

To minimize the impact of the HA failover, you can:

* use lcap-ha-slave enabled, to prevent the LACP negotiation to be performed after the failover (the LACP links are already up, but are not used for the traffic).

* use OSPF graceful restart on the FGT and the Nexus, so the traffic with still goes through the Fortigate during the OSPF neighbor relationship completion.

Benoit

[Nils]

Otherwise you could connect each Fortigate to one Nexus and then you don't have to use a VPC and therefore use OSFP as you want.

So 2x1/10Gb interfaces connected from Fortigate1 to Nexus1 and 2x1/10Gb from Fortigate2 to Nexus2.

Edit: Didn't see that the post above gave the same suggestion.

[Ed1]

Hi,

Did you find a solution to the above problem?