fortigate Failover query

[sonydarrel]

Dears

Please find the attached topology.

I have some problem in understanding the fail over, whenever the port channel interface of DC-1 fails it shifts over to DC-2 FW but the perimeter firewalls doesn't shift and the traffic gets drops, what should be done to make perimeter-2 FW to be active with DC-2 FW.

Thanks

[lobstercreed]

Hi Sony,

Your physical design is flawed...the firewalls are not meshed.  You need to connect FG-INT1 to FG-DC2 and FG-INT2 to FG-DC1 so that you have true redundancy.  This can most easily be done physically if you can put a switch between the FG-INT and FG-DC FortiGates, but you could also achieve this logically with additional routed links.  Then it wouldn't matter that FG-INT1 was still operational when FG-DC2 took over. 

Another thought is that you potentially don't even need 4 firewalls...  Assuming there's enough capacity, you can put the DC and perimeter all on one HA pair using different VDOMs if necessary.  We're a small shop, so we just run everything on one set of boxes that I manage (single VDOM).

- Daniel Hamilton

[sonydarrel]

Dear

i don't have additional switches what will be configuration according to your suggestion below

You need to connect FG-INT1 to FG-DC2 and FG-INT2 to FG-DC1 so that you have true redundancy.

Is the issue can  be achieved by remote link failover feature as per the link below.

https://help.fortinet.com...A_failoverAttached.htm

[lobstercreed]

Sony,

I think you're on to the best solution there with Remote Link Failover.  I haven't had to use that feature but it seems like it would be exactly what you need.  You could ping an interface on your Cisco Core and use that to determine the flip.

Without a switch in between, the only other way I could see it working is by setting up additional links (assuming you have physical interfaces available) from FG-INT1 to FG-DC2 and FG-INT2 to FG-DC1.  You would then need to use a dynamic routing policy to manage the routes, but engineering all that sounds much more complicated than remote link failover.

- Daniel

[ede_pfau]

IMHO you set up the links between the FG-INT and FG-DC as aggregated ports (LACP trunks), with 2 ports. One for each opposite FGT. It's been already mentioned that 2 links are missing. Don't get confused by the HA links - they don't carry routed traffic, just synchronization.

And if you can avoid it never put switches inbetween, they are just another point of failure.

[lobstercreed]

Ede,

I did not know that you could do MC-LAG on the FortiGate?  That is a great solution if its possible!  Can you provide documentation where this is explained?  All I can find when I search it is regarding FortiSwitches.

Thanks - Daniel