Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
sonydarrel
New Contributor

fortigate Failover query

Dears

 

Please find the attached topology.

 

I have some problem in understanding the fail over, whenever the port channel interface of DC-1 fails it shifts over to DC-2 FW but the perimeter firewalls doesn't shift and the traffic gets drops, what should be done to make perimeter-2 FW to be active with DC-2 FW.

 

Thanks

 

 

5 REPLIES 5
lobstercreed
Valued Contributor

Hi Sony,

 

Your physical design is flawed...the firewalls are not meshed.  You need to connect FG-INT1 to FG-DC2 and FG-INT2 to FG-DC1 so that you have true redundancy.  This can most easily be done physically if you can put a switch between the FG-INT and FG-DC FortiGates, but you could also achieve this logically with additional routed links.  Then it wouldn't matter that FG-INT1 was still operational when FG-DC2 took over. 

 

Another thought is that you potentially don't even need 4 firewalls...  Assuming there's enough capacity, you can put the DC and perimeter all on one HA pair using different VDOMs if necessary.  We're a small shop, so we just run everything on one set of boxes that I manage (single VDOM).

 

- Daniel Hamilton

sonydarrel

Dear

i don't have additional switches what will be configuration according to your suggestion below

You need to connect FG-INT1 to FG-DC2 and FG-INT2 to FG-DC1 so that you have true redundancy.

 

Is the issue can  be achieved by remote link failover feature as per the link below.

 

https://help.fortinet.com...A_failoverAttached.htm

lobstercreed

Sony,

 

I think you're on to the best solution there with Remote Link Failover.  I haven't had to use that feature but it seems like it would be exactly what you need.  You could ping an interface on your Cisco Core and use that to determine the flip.

 

Without a switch in between, the only other way I could see it working is by setting up additional links (assuming you have physical interfaces available) from FG-INT1 to FG-DC2 and FG-INT2 to FG-DC1.  You would then need to use a dynamic routing policy to manage the routes, but engineering all that sounds much more complicated than remote link failover.

 

- Daniel

ede_pfau

IMHO you set up the links between the FG-INT and FG-DC as aggregated ports (LACP trunks), with 2 ports. One for each opposite FGT. It's been already mentioned that 2 links are missing. Don't get confused by the HA links - they don't carry routed traffic, just synchronization.

 

And if you can avoid it never put switches inbetween, they are just another point of failure.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
lobstercreed

Ede,

 

I did not know that you could do MC-LAG on the FortiGate?  That is a great solution if its possible!  Can you provide documentation where this is explained?  All I can find when I search it is regarding FortiSwitches.

 

Thanks - Daniel

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors