Skip to main content
tonylin1
Staff
Staff
January 27, 2025

Technical Tip: How to add IPsec tunnel created by wizard into IPsec Aggregate.

  • January 27, 2025
  • 0 replies
  • 467 views
Description This article describes how to add an IPsec tunnel created by Wizard into IPsec Aggregate.
Scope FortiGate v7.2.
Solution
  1. IPsec tunnel is created by the Wizard.

 

截圖 2025-01-27 下午3.19.14.png

 

  1. When trying to add it into IPsec Aggregate, it needs to set 'aggregate-member' in phase1 settings.

 

截圖 2025-01-27 下午3.15.48.png

 

  1. It will pop out an error message when trying to set 'aggregate-member enable' in phase1 settings.

config vpn ipsec phase1-interface

(phase1-interface) # edit a

(a) # set aggregate-member enable

(a) # end
Please enable phase2 auto-negotiate if ipsec-aggregate uses redundant algorithm.
This interface is currently in use.
object set operator error, -23, roll back the setting
Command fail. Return code -23

 

  1. Remove the config related to phase1 including firewall policies and static route.

 

截圖 2025-01-27 下午3.17.14.png

 

  1. It is possible to add a tunnel interface to the IPsec aggregate now.

 

截圖 2025-01-27 下午3.18.27.png
    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
    Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT