Example active-passive redundant link configuration

FortiGate-5050 fabric backplane communication

For an active-active configuration, you create two or more spanning tree instances on all three devices and give some instances a higher priority on one FortiSwitch-5003A board and give other instances a higher on the other FortiSwitch-5003A board. While both FortiSwitch-5003A boards are operating, the spanning tree configuration distributes traffic to both boards. If one of the FortiSwitch-5003A boards fails, spanning tree redirects all of the traffic to the board that is still operating.

Note: If you have more than one spanning tree instance you can still configure an active-passive configuration by setting the priorities of all spanning tree instances to be higher for the same FortiSwitch-5003A board.

In both active-passive or active-active configurations, if one of the

FortiSwitch-5003A boards fails, sessions are temporarily interrupted because the

FortiSwitch-5003A boards do not store session information.

Example active-passive redundant link configuration

Figure 22 shows an example redundant link aggregation configuration. In this configuration an external switch is connected to two FortiSwitch-5003A front panel F5 interfaces. The switch adds VLAN tags to traffic from the internal and external networks. Packets from the internal network are tagged as 100 and packets from the external network are tagged as 101.

To make this an active-passive configuration, the spanning tree instances on the FortiSwitch-5003A board in slot 1 should have a higher priority than the spanning tree instances on the FortiSwitch-5003A board in slot 2. The FortiSwitch-5003A board in slot 1 becomes the root for both spanning tree instances. Because of the priority settings, MSTP sends all packets to the FortiSwitch-5003A board in slot 1. If this board fails, MSTP re-directs all packets to the FortiSwitch-5003A board in slot 2.

For a given spanning tree instance, MSTP directs packets to the device with the lowest priority value. To give a spanning tree instance a higher priority on a device you must configure the instance on that device with a lower priority value. The lower priority value gives the device a higher spanning tree priority for a given spanning tree instance.

In this example the spanning tree priority values on the FortiSwitch-5003A board in slot 1 are both set to 4096 and the spanning tree priority values on the FortiSwitch-5003A board in slot 2 are both set to 40960. Spanning tree directs all traffic to the FortiSwitch-5003A board in slot 1.

All of the FortiGate-5001A boards must be operating in transparent mode and all must have the same configuration. In this redundant configuration, traffic can be re-directed from one fabric channel to another after a FortiSwitch-5003A fails or if you change the MSTP configuration. To make sure the FortiGate-5001A boards can continue to process traffic after a failure or NSTP configuration change you must add redundant configurations to both fabric interfaces. This means adding 2 VLAN interfaces to each fabric interface (one for each VLAN tag) and configuring duplicate firewall policies and routing for both sets of VLAN interfaces.

 

FortiSwitch-5003A and 5003 Fabric and Base Backplane Communications Guide

60

01-30000-85717-20081205

Page 60
Image 60
Fortinet 5003A manual Example active-passive redundant link configuration

5003, 5003A specifications

Fortinet's FortiGate 5003 and 5003A are high-capacity, next-generation firewalls designed for enterprises that require advanced security solutions with a strong focus on performance and scalability. These models are part of Fortinet's expansive line of FortiGate appliances, which leverage innovative technologies to provide robust protection against a variety of cyber threats while maintaining seamless network operations.

One of the standout features of the FortiGate 5003 and 5003A is their impressive throughput capabilities. With multiple high-speed network interfaces, these firewalls can handle substantial amounts of traffic, ensuring that data flows smoothly without creating bottlenecks. This makes them ideal for organizations that operate large-scale networks or have significant bandwidth demands.

The FortiGate 5003 series is equipped with Fortinet's proprietary FortiOS, an intuitive operating system that integrates firewall, VPN, antivirus, intrusion prevention, web filtering, and application control functionalities. This comprehensive approach to security allows organizations to protect their networks from an array of cyber threats while simplifying management and reducing operational costs.

Another key characteristic of these models is their use of Fortinet's purpose-built security processing units (SPUs). These hardware-accelerated security chips enable accelerated threat detection and prevention, allowing the 5003 and 5003A to deliver high performance even when advanced security features are enabled. The SPUs play a crucial role in ensuring that organizations can enforce security policies without compromising on speed or efficiency.

Furthermore, the FortiGate 5003 and 5003A support advanced networking features, including Virtual Routing and Forwarding (VRF), which allows for better traffic management and segmentation. This capability is essential in multi-tenant environments, enabling organizations to create isolated networks while maintaining centralized security management.

In addition to their performance and feature set, both models support centralized management through Fortinet's FortiManager platform, providing a unified view of network security across multiple devices. This simplifies configuration, updates, and policy compliance, significantly reducing administrative overhead.

Finally, the FortiGate 5003 and 5003A are designed with redundancy and high availability in mind. They include failover capabilities and support for clustering, ensuring that network operations remain uninterrupted even in the event of hardware failure. This level of reliability is vital for mission-critical applications where downtime can lead to significant operational disruption.

In summary, Fortinet's FortiGate 5003 and 5003A are powerful solutions that combine high performance, advanced security technologies, and robust management features to meet the needs of large enterprises. With their focus on scalability and reliability, these firewalls are poised to protect organizations against evolving cyber threats while ensuring optimal network performance.