Best way to connect 3650 stack to Fortigate 300D HA

[Joel Melashenko]

I am attempting to implement a Fortigate 300D HA scenario.  Currently there are 2 Cisco 3650 in an active-standby stacked configuration.  Currently, this stack connects to the LAN port on a single Fortigate 300D.  The configuration of the switch port is shown below:

interface gigabitethernet1/0/2
description ***uplink to fortinet internet fw***
no switchport
ip address 192.168.31.2 255.255.255.252
no cdp enable

Question:  How do I best connect a port on each 3650 in this stack to port 1 (LAN) on each Fortigate 300D in the proposed HA (Active-passive) cluster?

Is it best to create a vlan (31), make port 1/0/2 and 2/0/2 a member of the vlan (31), and give vlan 31 the address of the current port connected to the Cisco stack?

I will attach a proposed network diagram

I believe I have the Fortigate HA piece figured out, but would appreciate input on how best to connect the 3650 stack to the 2 Fortigate 300Ds given that they will be the gateway to the default route to the Fortigate 300D

Thanks in advance for your input.

[Reza Sharifi]

Not sure if Fortigate support vlan (layer-2), if not I think you can bundle ports 1/0/2 and 2/0/2 using a Portchannel and use LACP with IPs (layer-3).

HTH

[Joel Melashenko]

Hi Reza, thanks for your suggestions.  I'll check to see if Fortigate will support Vlan.  Would you make the port channel (LACP) in a vlan (31 in my example) or do you simply give the port channel the address itself?

Thanks for your help!

[Reza Sharifi]

Hi,

I would simply add the physical interfaces to a Portchannel and give it an address (one IP for each side of the Portchannel).  Also, LACP is standard and supported almost by all vendors.

HTH

[Deepak Kumar · Accepted solution]

Greeting.

As per your network diagram, L3 port-channel will not work for you becuase In HA configuration due to load balancing behaviour of a port channel. Fortigate will not accept any packet on the secondary/backup device there is no matter that it is active-passive or active-active.

My suggestion to go with L2 to port-channel with VLAN. One port-channel for Active FortiGate and second for the secondary FortiGate.

But keep in mind that by default FortiGate will not monitor Port-Channel's ports status. You must configure a command under the Fortigate LACP configuration "Set minimum link 2".

Regards,

Deepak Kumar

[Joel Melashenko]

Thanks so much for the detailed answer Deepak.  I will test your config suggestion once I'm back at work.  Appreciate your help!

~Joel

[Chris McCann]

did you solve this problem ?