We are planning to connect a pair of QFX 5200 (QFX is a WAN device where ISP connections terminates) and a pair Fortinet 3800. Fortinet further connects to my LAN core switch.

For redundancy purpose we are planning to connect QFX and Fortinet in criss-cross so the each QFX will connect to each Fortinet. Now, Fortinet that runs in HA mode (active-active), should be able to talk to the same gateway IP in QFX.

Each QFX has L3 separation no L2 link between them. So I cannot run VRRP on them.

In this case, how do I provide redundant out going gateway in QFX. In each QFX I can have an aggregated interface and assign a IP to it. But I cannot have two WAN outgoing gateway IPs in the Fortinet without vrrp. In Fortinet HA mode, it is just one single config for both units. It internally syncs the config to other firewall.

Any thoughts?

  • On the switches, are the connections from the routers terminated as layer-2 or layer-3?
    – Ron Maupin
    Dec 31 '16 at 16:29
  • It is layer 3...
    – user88975
    Feb 7 '17 at 13:40
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin
    Aug 6 '17 at 20:05

If the Fortinets are connected to the QFX via layer-3, then they are routing, and you don't configure gateways for routers. Routers learn routes in three ways: directly connected network, statically configured routes, or through routing protocols.

If everything is connected via layer-3, then you run OSPF, and let the routing protocol handle the redundancy. The two WAN routers should have default routes to the Internet, and you inject those into OSPF.

  • In your question you asked, switch to router, they are layer 3. And Fortinet to Switch is layer 2. We do not want to turn on ospf in Fortinet.
    – user88975
    Feb 7 '17 at 14:21
  • That is the proper way to achieve redundancy between routers, and a layer-3 switch with layer-3 connections is a router. Running OSPF on it will not affect the layer-2 connections.
    – Ron Maupin
    Feb 7 '17 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.