Network design is not fixed process. Every time when we add or change something in the network, we should analyze if the network is still resilient, as it was in the original design. Let's analyze below scenario: Firewall - Fortigate 5.x Core switch - Nexus 5k NX-OS 7.X Routing between core and firewalls - static With direct connection between FW01-Core01 and FW02-Core02 we can detect link failure easily. Firewalls here are in HA Active-Passive mode, what means the secondary box doesn't process any traffic. In case of Port1, Port2 or device failure - the secondary takes its role and sends ARP updates to the core switch. The same situation when Core01 or Core02 fails, FW01/02 can notice it and triggers failover. Let's imagine your are tasked to put IDS between core switches and perimeter firewalls, like on the diagram below: What is wrong with this scenario? Let's think if following failure scenarios are backed up: 1) FW01/Port1/Port2 failure -