need help in Nexus switch

[mabuzaid1]

Dear Cisco Support Community ,

Thank you all in advance .

I am new to Cisco nexus switch and as of now i have simple question for connection with layer 2 uplink (firewall):

our Scenario is we have two c9000 series and we have two fortigate firewall.

the Scenario is we need to connect a server with two links (one link to each switch "9000 series") and then the server Shall ping to fortigate (through the trunk port connected between the switch and Fortigate ).

Here i have attached the schame for the network .

I had also posted this issue before (i got it till some stage and then after that we are unable to complete what ever appeared later) .

I will share also the link of the previous post. 

https://community.cisco.com/t5/data-center-switches/need-help-with-nexus-switch/m-p/4105322#M5991

Note The VPC seems to be working (show VPC shows everything is good , however we can't ping from / to switch and fortgiate .

Eagerly waiting your help.

Config for Link between fortigate and nexus switch :

Nexus 1
===========
interface port-channel17
description ***To-FW-1***
switchport
switchport mode trunk
vpc 17

interface port-channel18
description ***To-FW-2****
switchport
switchport mode trunk
vpc 18

interface Ethernet1/17
switchport
switchport mode trunk
channel-group 17
no shutdown

interface Ethernet1/18
description ***To-FW-2***
switchport
switchport mode trunk
channel-group 18
no shutdown

Nexus SW 2
==========

!
interface port-channel17
description ***To-FW-1***
switchport
switchport mode trunk
vpc 17
!
interface port-channel18
description ***To-FW-2****
switchport
switchport mode trunk
vpc 18
!
interface Ethernet1/17
description ***To-FW-1***
switchport
switchport mode trunk
channel-group 17
no shutdown
!
interface Ethernet1/18
description ***To-FW-2****
switchport
switchport mode trunk
channel-group 18
no shutdown

Thanks

[TONY SMITH · Accepted solution]

So your choices are either one subnet/VLAN or two ...

(1) Single channel group and subnet on the Fortigate, connecting to a VPC on Nexus 1 and 2.  Nexus 3 and 4 configured as a second VPC domain, connected to 1 and 2 as a double ended VPC.  Devices connected to 3/4 are not going to see any detectable performance hit as a result of passing through 1/2 on their way to the Fortigate.

(2) Two separate channel groups and subnets on the Fortigate, one connects to Nexus 1/2 and one to Nexus 3/4.  Create a Layer 3 path between Nexus 1/2 and 3/4.

[mabuzaid1]

Thanks Tony for your patient and quick response these were very helpful discussions .