3

I have inherited a rather weird setup at work, although my forte is servers and cloud, I have to look into network matters as well due to lack of resources.

This setup has 2 x Fortigate 100Ds (FG1, FG2) and 2 x Cisco 2960X switches (SW1, SW2) will be added as expansion because Fortigates ran out of free switch ports.

Topology is as below:

(VLAN A, B) FG1 <== HA1 Port (Trunks VLANs A, B) ==> FG2 (VLAN A, B)

Hosts on FG1's switch ports are able to access to hosts on FG2's switch ports.

All switch ports are in access mode, no trunk. Only trunk is on HA1 port.

New topology will be like this: 

   FG1 <== TRUNK ==> FG2  
   ||                ||
   ||                ||
  TRUNK             TRUNK
   ||                ||
   ||                ||
   SW1 <== TRUNK ==> SW2
    |                 |
    |                 |
  HOSTS             HOSTS

Target is to stop using switch ports on both Fortigates, so all of them will be moved to these 48 port switches, if any of the Fortigate is down, we need all of the hosts in same VLANs to be able to access to each other.

For example, if FG2 is down, topology will be reduced to this

   FG1   
   ||               
   ||               
  TRUNK             
   ||                
   ||                
   SW1 <== TRUNK ==> SW2
    |                 |
    |                 |
  HOSTS             HOSTS

How might I be able to do this without causing a loop?

Improve this question
5
  • 1
    Are you asking how to set up spanning tree in your first picture to prevent a loop? You should know that by defult, Cisco uses a proprietary version of spanning tree protocol. You can configure both the Fortinet and Cisco to use MST (multiple spanning tree, 802.1s), so they will be compatible.
    – Ron Trunk
    Nov 16 '16 at 15:02
  • @RonTrunk Yes. I didn't know about MST. I was talking to a friend about using STP to prevent looping but I was told it could happen all the same, advised me to move everything to one of the Fortigates first, sever the trunk between FG1 and FG2. Concern with this approach is it will involve another major reconfiguration and cause downtime in multiple services.
    – user29422
    Nov 16 '16 at 16:50
  • If spanning tree is set up correctly, it will prevent loops (that's what it's for). If you provide more details, we can dig a bit deeper. But you should be able to prevent major outages.
    – Ron Trunk
    Nov 16 '16 at 17:15
  • @RonTrunk I will try to be as descriptive as possible. What other details might help identifying the use case?
    – user29422
    Nov 16 '16 at 17:18
  • As a beginning strategy, make SW1 the root bridge for all Vlans. I assume all the links will have the same cost.
    – Ron Trunk
    Nov 17 '16 at 15:56
3

We didn't want to take the risk of this design and STP compatibility issues between FG and Cisco and changed our design to something safer and more redundant.

For our new design, we migrated all hosts (policies) from FG1 to FG2, once FG1 is idle, we enabled HA cluster on FG2 and made FG1 slave to it.

FG1 and FG2 are no more trunked and we have full redundancy in case any of them is down or their monitored interfaces like WAN or trunks to switches.

    FG1 <====HA1+HA2 (Heartbeat for HA)====> FG2
     ||                                       ||
     ||                                       ||
   TRUNK (standby)                          TRUNK (live)
     ||                                       ||
     ||                                       ||
    SW3 <===== TRUNK-ALL+ETHERCHANNEL =====> SW4
     |                                        |
     |                                        |
     |                                        |
   HOSTS                                    HOSTS

Thank you all again for other suggestions. They would have worked but couldn't risk with our limited experience.

Improve this answer
1
  • We are facing a similar issue, but instead of 2x Cisco 2960X, we have two Brocade ICX 6450 in a stack topology. Hardware switches in each FG unit are isolated, they don't form a loop at layer 2 when you join them with HA only. In Fortinet redundant-architecture cookbook, they draw two links between FG units, one labeled HA and the other labeled TRUNK, which are serving two distinct purposes.
    – Marco De Lellis
    Sep 16 '17 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy