Fortigate 100D Firewalls and HSRP

hsrpvmware

First, please see the attached network diagram to see what I am trying to do.

enter image description here

On the 2 distribution switches, we run HSRP and have one Fortigate going to SW1 and the other going to SW2.

Then we have vmware esx hosts with connections to each of the fortigates. The fortigates are configured in an active-active ha config as are the vmware vswitches.

Now for some reason, when we disconnect the cable from the monitored wan1 port on either of the fortigates, the ip assigned the a vm on either of the esx hosts fails to be reachable however the ip assigned to the fortigates is reachable just fine. For some reason, traffic isn't being passed through the fortigates.

However, if you look at this diagram, the vm ip is reachable just fine when the devices failover.

enter image description here

I've tried setting different interface tracking options in hsrp and tried using "ip sla" as well to no avail.

Am I missing something somewhere either on the fortigates or on the distro switches?

Best Answer

Let me preface this by saying that I have not used Fortigate, but speaking generally.

You should have two links from each firewall (FW ), one to each switch (SW), just as you have a link from each FW to each server (SRV).

This is what I suspect is happening. Assuming SW1 is the HSRP active interface, it initially receives traffic from SRV2 on the link to SW2 and creates an entry in the MAC and ARP tables. When the link between SW2 and FW2 goes down, SW2 removes the entries for that interface from it's tables, but SW1 doesn't know the link is down and maintains it's entries.

When traffic comes in to SW1 for SRV2, it looks up the ARP/MAC information and sends the traffic to SW2. SW2 doesn't have an entry for SRV2 anymore, and floods it out all ports except the one it received the traffic on (normal switch operations). This results in the traffic never reaching SRV2 as none of the other links on SW2 provide a path to SRV2.

With the second link the traffic between FWs and SWs, the flooded traffic would then be received at FW1 and be able to get to SRV2.

If you have outbound traffic from SRV2 after the link goes down, or you clear the MAC entries on SW1, I suspect that this would work as well.

Related Topic