STP with Active-Passive HA?

[Guillaume_Filion]

Hi, I have two FG100D in a Active-Passive setup and I' m a bit confused about plugging switches to them. Since I have 16 switch ports on the FG, I want to use it as my backbone switch. So for each switch, I connect one port to the Active FG and another port to the Passive FG. Immediately when I connect more than one switch like this I get a broadcast storm. It' s as if the ports on the Passive FG are active but discarding STP messages. But the HA docs say that I should only care about STP if I' m setup as Active-Active. It feels like I' m missing something obvious... How do you guys connect your network when in Active-Passive HA? Thanks in advance, Guillaume

[emnoc]

Hmm, if you want " HA" . I don' t see how connecting 2 FGT together is going to give you HA. I would suggest you review the HA configuration guide. I only connect the HA-interface link between units in a cluster. http://docs-legacy.fortinet.com/fgt/handbook/50/5-0-6/fortigate-ha-50.pdf

[Guillaume_Filion]

The FG are not connected to each other (beside the HA ports). Here' s a simplified schema of my network. The loop occurs between the Active FG, the Cisco Switch, the Passive FG and the Avaya Switch. I don' t see how I could plug this any other way and still have HA.

[emnoc]

okay much clear now. Now what mode of operations nat or transparent ?

[netmin]

Our test configuration on 100D A/P (NAT) looks (simplified) similar (if you additionally connected both switches directly). All our devices are running RSTP. The passive FGT maintains it' s switch mode and RSTP is working fine with it (one connection designated/forwarding, one connection alternate/discarding. Additionally, we have split the FGT switch into multiple hard-switch interfaces, each connected to both switches and it still works as intended using RSTP.

[emnoc]

In passive-FGT does it generate BPDUs? FWIW: I never hooked up a FGT in HA using a switch-hub interface, now that I think about it more, I never seen any one do that with FGT clusters.

[netmin]

@emnoc: Testing, evaluating, looking for alternatives to redundant interfaces (there are not to many on the 100D) BPDUs - no - because in order to create multiple hard-switch interfaces, one needs to set the internal-switch-mode to ' interface' . At the same time STP can only be configured on internal switch in switch mode. No STP on the FGTs in this test configuration. The hard-switch interfaces are forwarding BPDUs, so it' s external switch-vs-external switch handling the connection. As the external switches are directly interconnected via preferred paths, this can work.

[Guillaume_Filion]

okay much clear now. Now what mode of operations nat or transparent ?

NAT

FWIW: I never hooked up a FGT in HA using a switch-hub interface, now that I think about it more, I never seen any one do that with FGT clusters.

What setup have you seen? Using a independent backbone switch and only connect this switch to the FGT? I' m a FGT newbie so my setup might not be following the best practices...

Our test configuration on 100D A/P (NAT) looks (simplified) similar (if you additionally connected both switches directly). All our devices are running RSTP. The passive FGT maintains it' s switch mode and RSTP is working fine with it (one connection designated/forwarding, one connection alternate/discarding.

Did you enable stpforward on the FGT or did it work out of the box? Thanks a lot, Guillaume

[netmin]

@Guillaume no, on hard-switch interfaces we don' t have stpforward enabled, however BPDU packets are forwarded on the active and passive FGT.

[Sean_Toomey_FTNT]

Hi Guillaume, Sorry to hear of your issue. You do have a couple of different options here. If you are getting a broadcast storm you almost certainly have a loop somewhere. First, because you are in a cluster, you won' t really be able to plug any users or servers straight into the FGT, just the Avaya and Cisco switch. This being the case, unless I' m missing something, you aren' t gaining much by having the FGT in switch mode anyway. I would think about doing the following design: 1. Change the FGT from switch mode to interface mode. 2. Have your ISP plug into the Cisco switch on it' s own VLAN 3. Have WAN1 from each FGT plug into the Cisco switch (NOTE: If your ISP has two ports they can give you, optionally ignore steps 2 and 3 and plug them directly into WAN1 of each FW if you' d like) 4. Have HA1 and HA2 from FGT-1 plug into HA1 and HA2 on FGT-2 for two directly connected Sync networks 5. Use one of the ports, (port1 for arguments sake) for Cisco switch, and plug port1 from each FGT into Cisco switch 6. Use another port (port2 for arguments sake) for Avaya switch, and plug port2 from each FGT into the Avaya switch. 7. Write firewall policy as appropriate between the two interfaces, as well as from those interfaces to Internet The reason why I am thinking along these lines is as follows: 1. STP problems go away. No need to worry about that anymore 2. It is best practice to have servers and other sensitive/crucial resources firewalled off from the general network 3. If reduces the chance that a single link failure will cause any network impact (such as STP or RSTP having to converge again). Hope this helps. Cheers!