Fortinet Version 3.0 manual Example FortiGate HA cluster FortiBridge application

FortiBridge operating principles Example FortiGate HA cluster FortiBridge application

Example FortiGate HA cluster FortiBridge application

A FortiBridge unit can provide fail open protection for a FortiGate HA cluster operating in transparent mode in much the same way as for a standalone FortiGate unit. To provide fail open protection for an HA cluster, connect the FortiBridge unit to the switches that connect the internal and external interfaces of the cluster. Use the following steps to connect a FortiBridge unit to the HA cluster, as shown in Figure 7:

Figure 7: FortiBridge unit providing fail open protection for a FortiGate HA cluster

(Normal mode)
Internal network
INT 1	EXT 1	Internet
INT 2	EXT 2	Router
Internal	External	Probe packets
	HA cluster

(Transparent mode)

The network configuration and FortiBridge configuration are the same for a cluster and for a standalone FortiGate unit. In normal mode, packets pass through the FortiBridge unit and through the FortiGate HA cluster and back through the FortiBridge unit. For the cluster to process this traffic, you must add

Internal ->External firewall policies to the cluster configuration. If a failure occurs and the cluster no longer processes traffic, the FortiBridge unit switches to bypass mode, bypassing the cluster.

The connection procedure is different depending on whether the FortiBridge unit uses copper gigabit ethernet network connections or fiber gigabit ethernet network connections. This section includes the following connection procedures:

•Connecting the FortiBridge-1000 (copper gigabit ethernet)

•Connecting the FortiBridge-1000F (fiber gigabit ethernet)

Connecting the FortiBridge-1000 (copper gigabit ethernet)

The FortiBridge-1000 unit contains 4 auto-sensing 10/100/1000 Ethernet interfaces that connect to the internal and external networks and to the cluster interfaces that were connected to these networks. Use the following steps to connect a FortiBridge-1000 unit to the network as shown in Figure 7.

Note: Normally, you would use straight-through ethernet cables to connect the FortiBridge-1000 unit to the FortiGate unit and to your networks. However, for some connections you may need a crossover ethernet cable (for example, for compatibility with network devices that do not support Auto MDI/MDIX).

FortiBridge Version 3.0 Administration Guide	15
09-30000-0163-20061109