High Availability between 2 Fortigates 301E connected to 2 ISP links ?

[Lipe79]

Hi everyone! 

I need your precious help about this scenario, please see attached diagram below.

What do you recommend as being the best way to configure HA on these 2 Fortigates to work properly?

Active-Active or active-passive

Each one of the Firewalls is connected to ISP through only 1 link and the ISP is the same but has configured VRRP between ISPRouter1 and ISPRouter2.

Thank you so much!  Regards!

[lobstercreed]

Based on the info provided, I don't think you'll see any difference either way.  Just make sure the link to the ISP router uses the same port on both FortiGates.

See here for a list of best practices for HA:

https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-high-availability-52/HA_FGCP_best_pr...

This link specifically addresses the difference between AA and AP:

https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-high-availability-52/HA_FGCP_ap_aa.h...

[Lipe79]

Hi Lobstercreed,

Thank you for your help, I have configured active-passive mode but now I have a problem regarding this scenario I need to force the wan link to down when other interface that is being monitored goes down because the fortigate1 is changing the service to fortigate2 but the WAN interface stays up and the ISP Router are not changing to Router 2 when a failure occurs on another interface.

What is the best way to accomplish this?

Thank you so much!

Regards, 

Filipe

[lobstercreed]

The typical solution is to put a switch between the HA cluster and each ISP router, creating a mesh.   You can use a couple of cheap unmanaged switches for this purpose to avoid a single point of failure.

This will give you some additional redundancy in case ISP1 fails at the same time FG2 fails, then ISP2 can still talk to FG1. 

It should also address your scenario where FG1 goes down (artificially due to monitored interface)...you'll still be able to use ISP1.

You may need to configure a couple additional interfaces on the firewall depending on how you set it up.

[Lipe79]

Exactly but due that was not agreement about adding a switch, the idea is when an monitored interface fails on FG1 automatically the link to ISP-Router1 also must be turned down and the FG2 assumes the master and the the ISP-Router2 assumes the primary through the VRRP on ISP side.

I have found this link: https://kb.fortinet.com/kb/documentLink.do?externalID=FD44679

I need something like that with the difference rather than the monitored link be the WAN in my case it should be the interfaces from Networks 1,2 and 3 (stacks). 

What do you think about this possible solution?

Thanks for your help.

[lobstercreed]

Seems like it could work.  Not sure what the ramifications are with HA.  I think you would definitely need the two ISP links on different physical interfaces to prevent it disabling the good link on FG2 after failover.

[James_G]

You could have virtual clustering and vdoms and have a separate firewall (vdom) for each ISP that stays on the hardware with that connection, then a 3rd centralised vdom, and have the links between the firewalls / vdoms on your internal switches on an isolated vlan.

[lobstercreed]

How does that help the upstream ISP know to stop sending him traffic to VDOM-ISP1 when something on his centralized VDOM goes down?  It seems like that would get him farther from what he needs.

I would suggest a cheap hardware solution: couple of 5-port unmanaged switches.  But as software solutions go, I don't see where he has much better options than the one he presented.

[James_G · Accepted solution]

The centralised vdom in in an HA pair, it should never be down, and doesn't matter what node it's running on

[lobstercreed]

Ah, I think I get it now.  That's a cool idea!