Example Fortigate Ha Cluster Fortibridge Application; Connecting The Fortibridge-1000 (Copper Gigabit Ethernet) - Fortinet Version 3.0 Administration Manual

FortiBridge operating principles

Example FortiGate HA cluster FortiBridge application

Connecting the FortiBridge-1000 (copper gigabit ethernet)

FortiBridge Version 3.0 Administration Guide
09-30000-0163-20061109
A FortiBridge unit can provide fail open protection for a FortiGate HA cluster
operating in transparent mode in much the same way as for a standalone
FortiGate unit. To provide fail open protection for an HA cluster, connect the
FortiBridge unit to the switches that connect the internal and external interfaces of
the cluster. Use the following steps to connect a FortiBridge unit to the HA cluster,
as shown in Figure 7:
Figure 7: FortiBridge unit providing fail open protection for a FortiGate HA cluster
Internal network
The network configuration and FortiBridge configuration are the same for a cluster
and for a standalone FortiGate unit. In normal mode, packets pass through the
FortiBridge unit and through the FortiGate HA cluster and back through the
FortiBridge unit. For the cluster to process this traffic, you must add
Internal -> External firewall policies to the cluster configuration. If a failure occurs
and the cluster no longer processes traffic, the FortiBridge unit switches to bypass
mode, bypassing the cluster.
The connection procedure is different depending on whether the FortiBridge unit
uses copper gigabit ethernet network connections or fiber gigabit ethernet
network connections. This section includes the following connection procedures:
• Connecting the FortiBridge-1000 (copper gigabit ethernet)
• Connecting the FortiBridge-1000F (fiber gigabit ethernet)
The FortiBridge-1000 unit contains 4 auto-sensing 10/100/1000 Ethernet
interfaces that connect to the internal and external networks and to the cluster
interfaces that were connected to these networks. Use the following steps to
connect a FortiBridge-1000 unit to the network as shown in
Note: Normally, you would use straight-through ethernet cables to connect the
FortiBridge-1000 unit to the FortiGate unit and to your networks. However, for some
connections you may need a crossover ethernet cable (for example, for compatibility with
network devices that do not support Auto MDI/MDIX).
Example FortiGate HA cluster FortiBridge application
(Normal mode)
INT 1 EXT 1
EXT 2
INT 2
Internal External
HA cluster
(Transparent mode)
Internet
Router
Probe packets
Figure 7.
15