Skip to main content
Sindre-FTNT
Staff
Sindre-FTNT
Staff
October 28, 2019

Technical Tip: Represent Multiple IPsec Tunnels as a Single Interface

  • October 28, 2019
  • 0 replies
  • 4185 views

Description

 

This article shows a new option on FortiOS 6.2 to represent multiple IPsec tunnels as a single interface.

 

Scope

 

FortiGate.

Solution


With this feature, create a static aggregate interface using IPsec tunnels as members, with traffic load balanced between the members.
An IP address can be assigned to the aggregate interface, dynamic routing can run on the interface, and the interface can be a member interface in SD-WAN.
The supported load balancing algorithms are: L3, L4, round-robin (default), and redundant.


  1. Create a site-to-site VPN phase1 interface with net-device disabled:
config vpn ipsec phase1-interface
     edit tunnel1
         set interface port1
         set net-device disable
         set remote-ge 172.16.100.1
         set psksecret sample
         set aggregate-member enable
     next
     edit tunnel2
         set interface port2
         set net-device disable
         set remote-ge 172.31.1.1
         set psksecret sample
         set aggregate-member enable
     next
end
 
  1. Configure IPsec aggregation:
 
config system ipsec-aggregate
    edit agg1
        set member tunnel1 tunnel2
    next
end
  1. Configure a firewall policy:

config firewall policy
    edit 0
        set srcaddr all
        set srcintf port10
        set dstaddr all
        set dstintf agg1
        set schedule always
        set action accept
        set service ALL
    next
end
 
  1. Configure a static route:

config router static
      edit 0
          set device agg1
      next
end
 
To debug the IPsec aggregation list:

diagnose sys ipsec-aggregate list
    agg1 algo=RR member=2 run_tally=2
    members:
        tunnel1
        tunnel2

 

Note: 'aggregate-member' must be enabled under 'config vpn ipsec phase1-interface' in order to add the tunnel as an Aggregate Member. To enable 'aggregate-member' for existing tunnels, remove all references such as firewall policy and static route. It is not possible to enable 'aggregate-member' on a dial-up tunnel. 

 

Related articles: 

Terms & ConditionsAccessibility statement