Active-Passive Tunnel Identification Issue from Azure

Question

Hi,We have 2 ISPs at on-premises ISP1 and ISP2 in fortigate firewall.Two IPsec tunnels are created from on-premises to azure for site-to-site connectivity per ISP each.Azure VPN Gateway at cloud and Fortigate Firewall at onprem having connectivity using two different tunnels.Both tunnels are in connected state 24x7 but at fortigate it is configured like if primary ISP's tunnel goes down then only on-premises traffic flow through the secondary ISP's tunnel even though both tunnels shows in connected state in azure.But from azure side packets are flowing in both the tunnels and that's why whenever packets  are routed through secondary tunnel then that will be dropped at on-premises side. so for temporary basis we have to down the secondary tunnel so that azure do not send data through that tunnel. Is there any permanent solution for this issue? (we can not enable BGP since it is not supported in SKU we have, also can we achieve our goal via asymmetric routing or any other solution suggested to be configured at fortigate firewall?)

FredPaul · Answer

Hi!Without BGP the easiest way to do this is by using static routing and link monitoring. All this is done on the Fortigate side of things. So configure the two tunnels identically, that is with the same static routing etc (same distance and priority). Then do this:# config vpn ipsec phase1-interface edit set monitor endThis will bring the backup IPSec tunnel down, and it will stay down until the primary tunnel goes down. This way you don't have to worry about asymmetric routing etc.

Sign up

Login with SSO

Login to the community

Login with SSO