0

enter image description here

Hello everyone,

I’m currently working on setting up a redundant Layer 2 link using VXLAN over IPsec for a client. The attached diagram illustrates the current network configuration.

My objective is to ensure redundancy for the Layer 2 connection by leveraging VXLAN over IPsec. However, I am facing some issues, and I suspect the problem lies with the configuration of the Dell switches. Before I focus on the switch configuration, I want to make sure that the static routes on the FortiGate devices are set up correctly.

Here’s what I’ve configured so far:

  • On the FortiGate Audran, I have a static route to the 192.168.77.0/24 network via port11 with the gateway set to 192.168.77.1.
  • On the FortiGate Abreuvoir, I have a static route to the 192.168.77.0/24 network via port11 with the gateway set to 192.168.77.2.

(I admit, this feels a bit weird to me, but can't think of any configuration that would be more logical to me).

I’d like to confirm:

  • Are these static route configurations correct for this setup?
  • Should I adjust the routes or add additional configuration to better handle the redundancy
  • Is there any specific best practice when combining VXLAN over IPsec with such a Layer 2 setup?

Any guidance or suggestions would be greatly appreciated. Thank you in advance!

Improve this question
6
  • At first glance: do not use the same LAN subnet on both Fortigate sites, use different ones. You cannot easily override a directly connected subnet with a static route. Yes, that feels weird because it is. ;-) Beware of the encapsulation overhead of both IPsec and VXLAN - the MTU for the redundant link will be greatly reduced unless you can use baby giants.
    – Zac67 ♦
    Commented Nov 20 at 9:30
  • @Zac67 Thanks. Unfortunately, I cannot change the subnet configuration. Both sites must use the same 192.168.77.0/24 subnet, as it is a strict requirement for this setup. Regarding the VXLAN link, I’m aware that it’s not an ideal solution due to the encapsulation overhead and reduced MTU. However, the VXLAN link is intended to be used solely as a backup in case of a failure on the Layer 2 link. Its purpose is to maintain service continuity during the recovery of the primary L2 connection. Given these constraints, do you have any other suggestions? Thanks again.
    – Hypnosis9616
    Commented Nov 20 at 9:39
  • I remember that Fortigates don't like ambiguous subnets and the required workarounds, so good luck with that. I'd at least use distinct subnets between the Fortigates (via loopback, secondary address, ...) but I'm not sure that it'll fly even then. For the MTU, make sure you test well - it's no use to have a somewhat working fallback that the services on top can't use properly.
    – Zac67 ♦
    Commented Nov 20 at 9:51
  • @Zac67 Alright, could you elaborate a bit on what you mean by using "distinct subnets between the Fortigates"? Are you suggesting that even though both sites must retain the same 192.168.77.0/24 subnet for the connected devices, the Fortigates themselves should communicate over a separate subnet (e.g., via secondary IP addresses)? If so, how would this work in terms of routing and avoiding conflicts with the directly connected subnet?
    – Hypnosis9616
    Commented Nov 20 at 10:45
  • @Zac64 Here’s a link to a Fortinet article that demonstrates how the same subnet can be used on both sides: docs.fortinet.com/document/fortigate/7.2.9/administration-guide/… One thing to note, though, is that in the article's network diagram, there is no L2 link between the switches...
    – Hypnosis9616
    Commented Nov 20 at 11:03

1 Answer 1

Reset to default
0

You could enable Proxy ARP on the fortigates,then very carefully set up some static host routes on them: you'd tell audran that the route to TEST-CRAPTRAP (or whatever that says in the lower right) is over the VXLAN link's next hop (abreuvior). And then you'd tell abreuvior that the route to 192.168.77.11 is over the VXLAN link's next hop (audran).

Now you have a race condition. When 192.168.77.11 ARPs for TEST-CRAPTRAP, TEST-CRAPTRAP should answer first, assuming the L2 Link is up and not congested. The frames will stay in Layer 2 and will not hit the fortigates.

When the the L2 Link is down, then the audran will answer the ARP request. Thanks to the heinous host routes on audran, it wll will forward the frames over the VXLAN link to abreuvior, which will forward to TEST-CRAPTRAP.

This is a terrible idea, though. I would not want to be responsible for admining this network.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.