can be deleted

[AE111]

can be deleted

[balaji.bandi]

try below config :

switch 1 priority 15

switch 2 priority 14

Switch 1 fails Switch 2 become master and all the ports start working as expected in the data path.

Make sure you connect your uplink Switch 1 and Switch 2.

[Reza Sharifi · Accepted solution]

Hi,

1.  the stack shows the primary switch as master and the secondary one as member. How to make the secondary one to look as slave instead of member?

There is no need to change that. Salve and member are the same.

As long as you have uplink from both switches to the firewall when one switch fails, the other one will take over packet forwarding. Think of stack as one logical switch. You only configure the master and the master pushes the config to members.

HTH

[Joseph W. Doherty]

I've haven't work with 2960 stacks, but I believe they function (logically) like Catalyst 3K stacks, i.e. if the master fails, another stack unit will become the master and keep the config.  You will, of course, lose the ports of any stack unit that fails.

As to connecting devices to a stack, ideally, (at least on 3K stacks) you want an Etherchannel link between the stack and the other device with at least one link, of the Etherchannel, connected to different stack units.  If other device doesn't support Etherchannel, other choices include having the other stack unit port in the same VLAN (STP may be required) or a different VLAN (multi-homed).  Cannot say what your options are for your FW.  Check its documentation for something like redundancy options.

[AE111]

can be deleted

[Joseph W. Doherty]

That looks about right.

You could also use the same port numbers (except the member number) on both switches.  I.e. if you're using something like 1/0/47 and 1/0/48 now, you might use 1/0/47 and 2/0/47 or 1/0/48 and 2/0/48.

After you get the FW on the other switch member, you can "reclaim" the prior, now unused, switch port for another purpose.

[Reza Sharifi]

Hi Sinan,

Link aggregation with LACP should work. Since you are using the FWs in active/passive mode, I would also talk to FGT to make sure if the connection to the active firewall fails, the traffic is then routed to the backup FW and the backup FW uses the interlink to send the traffic to the primary FW to be forward it upstream and not get blocked.

HTH