0

I need some advice and guidance regarding setting up the FortiGate HA, My question is focused on WAN side of configuration (not A WAN expert), below are highlight environment

  • 2 ISP WAN-A / WAN-B
  • Firewall Hardware Fortinet F100.
  • WAN-A have Dedicated Switch (don't know its L2/L3)
  • WAN-B its a satellite dish it come straights from a dish to Firewall with RJ45.(no switch and that's the challenging part).
  • HA mythology is using virtual Mac for Failover (active/standby)

Here is my questions and appreciate the insight.

  • What type of Switch do i need for WAN-B L2/L3? (sitting between ISP and Firewall)
  • Does usually ISP help configuring the Switch and handed to the company?
  • What is the essential configuration do i need on the switch for WAN-B?

excuse my broken English.

2
  • Removed the off-topic request for a product recommendation.
    – Ron Maupin
    Nov 13, 2023 at 23:22
  • 1
    That sounds like a simple failover instead of HA. With HA, you would have two firewalls, each connected to both circuits (normally through a switch connected to each circuit).
    – Ron Maupin
    Nov 13, 2023 at 23:25

2 Answers 2

1

You would need to connect both ISPs to both firewalls if you want to retain the dual WAN design throughout a failover scenario.

If the satellite service cannot easily be connected to the second firewall, you can simply skip that part and keep it connected only to the primary firewall. If you ever have a failover, you will still have one working internet service and you can manually move the cable for the second ISP to the secondary firewall if desired.

Otherwise, you may need to talk to the satellite ISP to see if you can use a switch to allow the secondary firewall to be connected. They may simply tell you that it is not a supported design and you can test it if you want. Any basic switch should work for a simple test, especially if you do not require any special configuration on the existing connection with a single firewall.

You could also buy a 3rd internet service for the secondary firewall to use, if you really need a fully transparent failover design and the satellite internet won't work with a switch in between the firewall and the satellite device.

1
  • Thank you for the feed back,
    – KurdTech
    Nov 17, 2023 at 23:58
0

What type of Switch do i need for WAN-B L2/L3? (sitting between ISP and Firewall)?

Assuming an HA setup with dual firewalls: Actually, just about any switch will do. An unmanaged one has the advantage of being unhackable, but I'd recommend using a managed one (see below).

With a single firewall there's no need for a switch.

Does usually ISP help configuring the Switch and handed to the company?

The ISP usually configure their gear. From the handover port on it's all yours.

What is the essential configuration do i need on the switch for WAN-B?

With a dual firewall HA setup and a managed switch:

  • dedicated VLAN
  • no IP address/SVI on the VLAN
  • tagged/untagged port towards WAN as required by your ISP
  • untagged ports towards firewalls (for simplicity)
  • disable potentially incriminating protocols on the ISP side (xSTP, LLDP, ...)

The ISP router might not support dual routers on your side, so that might require special attention.

2
  • Thank you for your feedback much appreicate it
    – KurdTech
    Nov 17, 2023 at 23:56
  • @KurdTech You may vote for useful answers, and don't forget to eventually accept an answer if it solved your problem.
    – Zac67
    Nov 18, 2023 at 2:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.