VDOM-Active/Active

[nitesh_saxena]

Hi

I want to deploy active active with a shared outside interface having the same subnet ip address? is this feasible doing through VLAN sub interfaces? or we need have dedicated port for this??

[gschmitt]

Once you put two FortiGates into a HA cluster and configure a port (vlan or otherwise) those two ports share the same IP

So, yes? Not sure what VDOM has to do with it?

[jintrah_FTNT]

If the idea is to have 2 vdoms sharing the same default gateway address, yes, this can work too.

[emnoc]

OP,

Can you show a topology of your definition/requirement?

There's vdom partitions and then Act-Act . Vdom partitions is similar to cisco  method of  "Active-Active" where  you have 2 or more vdoms shared between 2 units in  a HA configuration;

e.g

vdom1 = unit1

vdom2 = unit2

vdom3 = unit1

vdom4 = unit2

NOTE: This allows you to load-balance or potentially  balance traffic BY VDOM. You could stack 2 low usage vdom on one unit a heavily one on the other.

e.g ( a 3 vdom concept )

vdom1 = unit1 ( low traffic  from custA )

vdom2 = unit2 ( high traffic from custB )

vdom3 = unit1 ( low  traffic from custC )

or

vdom1 = unit1 ( low traffic  from custA )

vdom2 = unit2 ( high traffic from custB )

vdom3 = unit1 ( medium  traffic from custC )

Now moving on, You also have  what's known as  Act-Act load-balance which can be used in w/1 vdom. Here the master unit in the A-A HA controls the loads balance traffic. Here a different  vritual mac is delivered to the client for load-balancing  requires. You don't have a shared physical subnet uplink per-se but logical the unit shared  the same layer2/3 information based on t he load-balance controls.

The same layer3 information is presented to the client, but the layer2 ARP is changed for each unit. This is similar to cisco GLBP if you evere have worked with  GLBP  and  understand it and the difference with  HSRP or VRRP .

In the pure Act-Act and vdom-partitioning, both units are processing traffic and upon a failover the  redundant mate handles all traffic. You will have fw-sessions on both units.

I figure I would explain that so we are all speaking the same thing when it comes down to understanding your needs. Each unit regardless needs the same interface configuration, fortios, model type, and the same rquires for the "actual port" your connecting to. So unit1 Port1(wan) connected to  layer2 port that 802.1q will need unit2 Port1(wan) connect to a 802.1q port.

I hope that clears it up a little since terms, methods are different between fortigate and cisco, juniper & others.