HA A-A - dualhomed access with BGP

[volkovski]

Hi all, Im trying to setup the following scenario : - 2x FG100D HA - AA mode. - 2x WAN access with BGP routing enabled. Is there any way to setup this configuration only with FGs (without using any other device) ? I have " 2 cables" , each from different ISPs ; provider independent IPs, BGP AS. My idea so far was to connect the first connection to FG#1 (WAN1) and the second one to FG#2 (WAN1). I' ve configured software switch (members WAN1, port1(Ports1 are connected between both FGs.)) to create SVI L3 with VLAN tag for each connection. I just need FG#2 to forward somehow traffic incoming from connection2 to FG#1 to form BGP neighborship with " backup ISP" . Thanks in advance.

[emnoc]

That' s not going to work and your trying to use HA in the wrong fashions. The Fortigates must be identical ( config,code,hardware,interfaces,etc...) and the same wan configration will be copied on each unit. I would suggest downloading the HA guide from kb on fortinet website.

[Matthew_Mollenhauer]

The one way I could see this working would be to not use Clustering for A-A, but have the units as two independent units. Each unit would talk to their respective BGP neighbor and take on the appropriate routing, you' d then have to configure a dynamic routing protocol between the units so that they can route between one another. You would also most likely need to setup VRRP on the inside interfaces to provide the " HA" . It wouldn' t be pretty, and I wouldn' t want to try it myself. A better option might be to simply buy a small managed switch that is capable of doing VLAN tagging. Put that between your ISP links and the Fortigates. You' d only need four ports: 2x ISP & 2x Fortigate. A small Cisco, Netgear or even a FortiSwitch should be suitable. An even better option would be to use proper dedicated routers out the front of your network. Using the Fortigates would require you to define policies for every possible traffic path that you could have, and if you are doing multihoming then it is entirely possible you' ll create asymmetric routes which result in a lot of deny traffic. Regards, Matthew Mollenhauer