CloudLabBox
Try the free demo

FortiGate SD-WAN lab 9 of 14

Dual hubs and data-centre failover

Add a second data centre: build HUB2's overlays, dual-home the Leeds branch to both hubs with BGP to each, join the hubs with a data-centre interconnect and floating routes, write rules that prefer each data centre's own hub, then take HUB1's internet edge down and prove that Leeds still reaches both data centres.

Run this lab

It needs Standard: its 7 nodes are set to 7 vCPU and 8,704 MB in total.

In your workspace: Shared, then FortiGate SD-WAN guided labs, then 09 - Dual hubs and data-centre failover

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 7 vCPU and 8,704 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 100 minutes
Nodes need
7 vCPU, 8,704 MB
Smallest plan
Standard

The scenario

Kestrel Logistics has opened a second data centre (DC2) with its own hub, HUB2, and a private interconnect (DCI) to DC1. The warehouse system lives in DC1 and its reporting copy in DC2. The design rule: each data centre is reached through its own hub while that hub is healthy, and through the other hub and the DCI when it isn't. HUB1 and Leeds (BR1) are already connected as in lab 06; HUB2 has only its addresses and internet access.

DeviceISP-A / ISP-BLANOverlays (hub address)Loopback
HUB1203.0.113.1 / 192.0.2.1DC1 10.1.10.0/24, H1 .50OL_A 172.16.1.254, OL_B 172.16.2.25410.200.0.1
HUB2203.0.113.4 / 192.0.2.4DC2 10.4.10.0/24, H4 .50OL_A 172.16.3.254, OL_B 172.16.4.25410.200.0.4
BR1203.0.113.2 / 192.0.2.210.2.10.0/24, H2 .50HUB1_A .1.2, HUB1_B .2.2, HUB2_A .3.2, HUB2_B .4.2-
ItemValue
BR1 SD-WAN members3 HUB1_A, 4 HUB1_B, 5 HUB2_A, 6 HUB2_B, all in zone overlay
Health checksHUB1_HC to 10.200.0.1 (members 3, 4); HUB2_HC to 10.200.0.4 (members 5, 6)
DCIHUB1 port4 10.0.14.1/30, HUB2 port4 10.0.14.2/30

Evaluation licence. IPsec on these FortiGates offers DES only, so the overlays use des-sha256 with DH group 14. Production uses AES-256-GCM with DH group 19, 20 or 21.

What you’ll practise

  • Design a dual-hub overlay with a separate health check per hub
  • Build a second hub and connect a branch to both hubs with BGP
  • Interconnect the hubs with static and floating routes and the right policies
  • Write SLA rules that prefer one hub and fail over to the other
  • Prove data-centre failover when a hub loses its internet edge

The tasks

  1. Start the lab
  2. HUB2's overlays
  3. Dual-home Leeds
  4. Interconnect the data centres
  5. Rules that prefer each data centre's hub
  6. Lose DC1's internet edge

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Dual hubs and data-centre failover7 nodes and 2 networks, 12 links. Every link is listed as text below the diagram.HUB1HUB2BR1INETH1H4H2ISP-AISP-Bport3eth0port3eth0port3eth0port1eth0port2eth1port1port2port4port4port1port2
7 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HUB1 port1 to ISP-A (network)
  • HUB1 port2 to ISP-B (network)
  • HUB1 port3 to H1 eth0
  • HUB1 port4 to HUB2 port4
  • HUB2 port1 to ISP-A (network)
  • HUB2 port2 to ISP-B (network)
  • HUB2 port3 to H4 eth0
  • BR1 port1 to ISP-A (network)
  • BR1 port2 to ISP-B (network)
  • BR1 port3 to H2 eth0
  • INET eth0 to ISP-A (network)
  • INET eth1 to ISP-B (network)
Nodes in Dual hubs and data-centre failover, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HUB1Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
HUB2Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
BR1Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
INETEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H4Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H2Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder FortiGate SD-WAN guided labs.

  3. Open 09 - Dual hubs and data-centre failover and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More FortiGate SD-WAN labs

All FortiGate SD-WAN labs

Related labs in other courses

CloudLabBox is independent of Fortinet. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.