Request for Guidance: Connecting Cisco C9300L Stack to FortiGate 100F in HA(Active-Passive) Mode

[Hari122939_]

Hello Team,

                 We are deploying two FortiGate 100F firewalls in an Active-Passive High Availability (HA) configuration with a Stack of two Cisco Catalyst 9300L switches. One of the LAN interfaces(Port 3 & Port 4) will be configured with LACP for link aggregation in the Firewalls. Below the firewalls, we have a stack of two Cisco Catalyst 9300L switches, in the Firewalls Port1 & Port2, with WAN ISPs(JIO & AIRTEL) links.

                 Considering our network topology, we are seeking your best failover guidance on the best practices to connect a Cisco C9300L stack to Active-Passive (High Availability) FortiGate 100F firewalls. We are attaching a proposed network diagrams for reference.

                 Your input on the configuration and uplink design would be greatly appreciated.

[funkylicious]

 i would go with plan A even tho the whole switch will go down, i would not want the isolate/take out a working equipment and not do anything.

as for the ISP, assuming that they also go in the stack then it would be easier to just move the cable from one sw to another in order to regain connectivity to a better uplink ( if its the case ).

[Toshi_Esumi]

It's not about FGT HA in the two scenarios, but it's about the purpose of Catalyst stacking. Because if you add the LAN side in HA monitoring interface in addition to the WAN side, the FGT1 would failover when the SW1 goes down.
However, the problem situation occurs when FGT1 and SW2 (or FG2 and SW1) have problem at the same time in plan B. The bottom line is when you "stack" switches, all LAG/LACP connections terminated at the switches should be split to two member switches. That's the one of two main purposes of stacking switches.

Toshi