cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
654
Views
5
Helpful
8
Replies

SDA fabric with a Fortinet firewall

Hi,
I wanted to interconnect my SDA fabric with a Fortinet firewall, how I can use static routes to ensure this connection
Thnx
1 ACCEPTED SOLUTION

Accepted Solutions

BGP is the recommended border handoff protocol. Static routes are supported, but not recommended. Redundancy with static routes is challenging in any network design, regardless of SDA or not-SDA, because static routes do not adapt to network state (e.g. neighbour down). You have all the standard static routing tools at your disposal such as floating static routes, or making the 9500 border an Stackwise Virtual (one logical switch comprising of two physical switches). If you choose to use static routes then on the border you would create an interface per SDA VRF (e.g. an SVI), connect those interfaces to the Fortinet, and manually program the static routes into the VRFs on the border. Please test your redundancy carefully before moving into full production.

View solution in original post

8 REPLIES 8
jedolphi
Cisco Employee

Hello. The Fortinet would connect outside of fabric e.g. to the SD-Access external borders. You can program the static routes as required on the external borders, and the return static routes on the Fortinet. I don't know of a document that explains this, but it's shouldn't be too hard to work out, it's just VRF routing on the external borders. HTH, Jerome

hello, 

the static route configuration  with GUI in DNAC or CLI at the border fabric level ??

 

i am very grateful for your support :)

 

 

Hello. You can configure on the border CLI directly, or you can use a DNA Center template if you feel that's appropriate. Cheers, Jerome

 

hello
 so i must create a sub-interface in the firewall for each VN ??

Hi, that should work just fine. Regards, Jerome

hello

If I understood correctly, the connection between the fabric border and the firewall does not depend on a Bgp session, so what configuration I have to set up at the L3 handoff menu level to use the static routing ? , I only see a connection through the VRF lite

 

one more question how I can ensure redundancy at the fabric borders knowing that I have two 9500 switches

 

Regards,

BGP is the recommended border handoff protocol. Static routes are supported, but not recommended. Redundancy with static routes is challenging in any network design, regardless of SDA or not-SDA, because static routes do not adapt to network state (e.g. neighbour down). You have all the standard static routing tools at your disposal such as floating static routes, or making the 9500 border an Stackwise Virtual (one logical switch comprising of two physical switches). If you choose to use static routes then on the border you would create an interface per SDA VRF (e.g. an SVI), connect those interfaces to the Fortinet, and manually program the static routes into the VRFs on the border. Please test your redundancy carefully before moving into full production.

View solution in original post

hello,

thank you so much for your support :)

 

Regards