Checkpoint/Fortinet firewall failover not working on internet interface

[devzero]

hi,

I am currently working on a project, with two proxmox hosts where on both are VMs where checkpoints and fortinet firewalls are hosted on.
Generally they are working fine, however if you shut down the switch port or disconnect the network cable on the interface where the internet connectivity is configured,
both firewall environment are not detecting that there a network disconnect has occured.
On the checkpoint VMs there is a DMZ network configured too, that switchover however worked, if the cable on the respective other interface is unplugged/or the switchport is disabled.

The Proxmox version is 8.4 and the network interfaces are configured with the openswitch and vlan mode is trunk with a certain range.
Support tickets to the FW vendors are already opened, however they are still investigating.

Does anyone has a similar setup and can give a hint where to check for the issue?
thanks

 

[bl1mp]

hi devzero,

that might become a tricky question. Would it be possible to provide us with the content of /etc/network/interfaces - file?

From your information so far, your setup at least seems to involve three network interfaces, from the perspective of the host:
- at least one physical NIC
- the VMBR above
- and the VMs actual interface.
So it is possible, that if the physical NIC gets disconnected, the VM won't realize, because the VM interface is still up.

If your hardware and your desired setup supports it, you can maybe pass through the physical ports via PCIe directly to your firewall VMs.

Maybe it is also helpful to elaborate a little bit on your planned setup? Do you try to archive HA on the Application (Firewall) Layer or maybe on the VM Layer by migrating the VM?

BR, Lucas