We have two managed switches (Draytek VigorSwitch P2261) in our (small) office. They are connected to each other with two ports (LACP).

We have four access points which provide plenty of coverage in our office, two of which are plugged into the first switch and two in the other. For redundancy, I'd like our network to continue operating if one of the switches dies (or is taking down for maintenance) but that would require both the switches to be connected to our router (Fortigate 60D). The little I know about networking tells me it's unlikely that just plugging both the switches into the router will work. (This lack of knowledge also made it hard for me to know what to search for, so my apologies if this is already answered somewhere)

So basically, my question is how can I achieve this? Or is it even possible?

Schematically, this is what I want to try to achieve:

          /---------- Switch 1
         /              |   |
Router  <               |   |
         \              |   |
          \---------- Switch 2

* edit *
Trying to make the question clearer:

The router/firewall in this case is just an example device, another device could be a NAS with at least two network ports for example. Ideally I would like to plug any LACP device with two ports into both switch 1 and 2 instead of both in the same switch. I've not been able to find out whether something like that is possible or not or if there is some other mechanism/protocol that allows you to do so.

  • good question ive never thot of that setup before. but what if u have a switch that connects the two switches but has one outlet to the router that way maintenance on switch 1 or 2 can not interrupt services. extra cost n all but just thinking out loud
    – Manny265
    Oct 24, 2015 at 23:38

1 Answer 1


There are many solutions to achieve redundancy on the first hop (Router). Normally one would use two routers which make use of a FHRP (First Hop Redundancy Protocol) like HSRP (Cisco-Propretary) or VRRP (open standard). A virtual ip address would be assigned to one of two routers and in case of failure a failover would occur and the standby router would take over the VIP.

Since in your case you have a firewall and not a router your solutions will differ. You only have one firewall in your disposal and want to connect it redundant to both your switches.

Many firewall vendors offer a "redundant" interface option. A secondary link may be connected to another switch and in case of the primary link going down a failover to the backup link would occur.

You may want to check your software version, FortiGate supports this feature http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%205.0%20Help/interfaces.100.12.html

  • Thanks for your quick answer, however, unless I'm misunderstanding that link talks about using multiple firewalls in a redundant manner. Not exactly what I'm looking for (I think), we currently have a cold-spare firewall in case the firewall drops out. I'll try to amend my question to make it clearer.
    – gwk
    Oct 23, 2015 at 8:54
  • Sorry, my bad I pasted the wrong URL. I have edited my answer which not includes a link to the description of fortigate redundant interfaces.
    – kaisero
    Oct 23, 2015 at 9:07
  • Ahh, thanks, that was exactly what I was looking for for the router. Now I'll just have to wait for everyone to leave the office so I can proceed with breaking everything while trying to get it to work :). I'll just have to figure out different solutions for other devices as they'll be installed.
    – gwk
    Oct 23, 2015 at 11:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.