After designing this I went in to start configuring equipment and quickly realized I was missing alot of information/understanding.

So the switches (A) between the modem and routers, do they need to be layer 3?

When setting up static IPs for the switches (A,B,C) - Would (A) use the modem IP as the gateway? (C) Would use the Virtual IP from the VRRP group on the bottom set of routers? And (B) idk what it would use at all since those 2 firewalls (Fortigate d90) are not what Im use to working with.

enter image description here

  • 2
    Hi and welcome to NE! We hope you become a contributing member of this community.We need more information in order to help you. Please include the Firewall configuration (sanitized). The answer to layer 2/layer 3 depends on how you have the firewall interfaces configured.
    – Ron Trunk
    Aug 28 '18 at 16:45
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 25 '18 at 9:18

Q. 1: no, the switches (A) do not need to route at all, that's what the firewalls are for. The only exception would be if the modems are located in a different subnet (but that is improbable).

Q. 2: I would point all switch gateways to the firewall cluster address. Whether they can reach the internet or not, and by which kind of service, is then under your control (via firewall policies). Typically, you would create a management VLAN (in your case, two) which terminates at the FGT.

Q. 3: Drop switch B if at all possible. Even if locally separated, the HA link between Fortigates should not run across active devices. Technically, it can, but the risk of a HA link failure is way higher than with just using wires (fibers).

And provide for 2 HA links for redundancy.

Q. 4: why VRRP? FortiOS HA provides all you need for sub-second device failover, active link and line monitoring, even load sharing. In my experience, VRRP takes ages in comparison to fail over, and would only be used if you had hardware from various vendors.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.