WAN switches - hardware recommendation

[kskit]

Hi,

We are planning to install two Fortigate firewalls in the HA Active - Passive cluster.

We have two 100/100 internet lines and we need to terminate each internet line on a switch to split it between the two Fortigates. A lot of diagrams show a single switch, but that introduces a single point of failure. I was thinking about deploying one switch per internet line and doing a mesh.

Can anyone recommend a pair of switches that could handle this setup? 

In our office we use 2920 series on the LAN side, but I was hoping that we could get away with somehting smaller.

I would be grateful for any recommendations

Thanks in advance

[parnassus]

---

kskit wrote: ...A lot of diagrams show a single switch, but that introduces a single point of failure. I was thinking about deploying one switch per internet line and doing a mesh.

---

That's it. If SPoF is what you really worry much you should adopt some sort of Virtual Switching technology at that switching level (backplane-fabric or frontplane stacking [*] <-- no VRRP is required) or to go down the VRRP path: in both cases you're going to connect each Fortinet FortiGate firewall with each virtual switch member breaking the SPoF.

[*] that will be possible by adopting an IRF technology approach using smaller HPE Comware base switches (5500/5120/5130 EI series, as example) or adopting recent VSF Virtual Switching Framework technology - available on Aruba 2930F, as example - or, more, backplane stacking (Fabric Stacking with dedicated Stacking Modules/Cables) supported on Aruba 2920, 2930M, 3800 or 3810M. It looks like Firewalls companies rarely consider this networking approach (maybe because setting up a VRRP on two switches could cost less than using any Virtual Switching approach for which there are HW/SW related specific restrictions <-- that should be verified because VRRP, as a feature, is not always supported on low end switches and so its adoption has restrictions too).

[kskit]

Thanks, that's very helpful. 

I did some Fortigate training yesterday, and the tutor suggested that we could even use a desktop TP-Link without affecting the performance. Obviously we are not going to do that, but I was wondering if there's any advantage in using stacked switches. 

My idea was that we will have a dedicated switch for each internet line, and each switch will connect to both firewalls on the WAN ports. Stacking would help with the management, but if one of the switches goes down, then there's nothing that the other can do, because it doesn't have the connectivity to the other interent line. Does that makes sense?

[parnassus]

Mmmm...since you wrote about HA Active/Passive I was thinking that both your firewalls have dual WAN connectivity in place...in this scenario both - the active and the passive - can be concurrently downlinked to a (virtual) Switch and that make sense to avoid SPoF - with respect to a single physical switch - at that specific level.

[kskit]

In the end we went with a pair of 2530 8G.

Nice littlte switches . It's a shame that they don't have the internal power supply, but they are doing the job.

Thank you for your input