Configuring a backup IPSec tunnel using the 'monitor' command

Question

Hey guys,

I have a box which I'm building a site-to-site tunnel on. The remote site has two locations, and my box should be able to 'fail' to the second location if the primary is unreachable.

From what I understand, this should be as simple as creating a phase 1 for each location, and using the 'set monitor "primary-phase-1"' on the secondary tunnel - like this:

config vpn ipsec phase1-interface
    edit "Primary"
        set interface "wan1"
        set nattraversal disable
        set comments "To Primary Location"
        set dhgrp 5
        set remote-gw XX.XX.XX.XX
        set psksecret ENC xxxxxxxxxxxxxxx
    next
    edit "Secondary"
        set interface "wan1"
        set nattraversal disable
        set comments "To Secondary Location"
        set dhgrp 5
        set remote-gw XX.XX.XX.XX
        set monitor "Primary"
        set psksecret ENC xxxxxxxxxxxxxxx
    next
end

That seems pretty straight-forward. But when I go to set up my static routes - do I just set up both of them the same? Do I need to weight the primary higher than the secondary?

Thanks

ede_pfau · Accepted Answer

The secondary will not be "up" until the primary VPN fails. If you point two identical routes (same distance, same prio) to Primary and Secondary, the FGT will load-balance (cf. ECMP) the traffic - which will lead to 50% packet loss.

So you need to apply identical distances but a higher prio ("priority" == "cost" in FortiOS) to the secondary route. That'll do.

(and of course 2 sets of policies, or one set of policies to a zone made up of the 2 VPN interfaces).

FatalHalt · Answer

Anyone have any insights here? Thanks

Sign up

Login with SSO

Login to the community

Login with SSO