Dual IPSec to same subnet for redundancy

basically you could have two tunnels to the same remote gateway.

On site B you will have to make sure that the Fortigate can differ  the tunnels.

Give them different proposals or/and set them to a specific peer id.

Also they have to have the specific remote gateway.

Then create two tunnels on Side A with different WAN and same remote gw.

The easiest thing then is to put both tunnels into a zone because then you only need to make the policies for the zone and not for every single tunnel. This must be done on both sides.

Then the most easiest way is the create redundant static routing for the needed remote subnet(s). That is you have a route to a subnet for every tunnel with same distance and different priority. This also has to be done on both sides.

this makes sure the traffic always uses the route with the lowest priority - except if this is gone down, then it will use the one with the next higher prio.

This is only one sulition, there may be others ;)

If you want site B to have a primary tunnel to site A and have the other tunnel as failover in the event that the primary vpn tunnel goes down this is very easy to do.

At site A

=======

Create tunnels

primary_2_site_B

secondary_2_site_B

create Zone site_B_tunnel

add tunnels primary & secondary

create static routes

10.20.0.0/16 next hop tunnel primary metric 10

10.20.0.0/16 next hop tunnel secondary metric 20

create rules

site_B-tunnel to site_A

site_A to site_B-tunnel

At site B

=======

Create tunnels

primary_2_site_A

secondary_2_site_A

create Zone site_A_tunnel

add tunnels primary & secondary

create static routes

10.10.0.0/16 next hop tunnel primary metric 10

10.10.0.0/16 next hop tunnel secondary metric 20

create rules

site_A-tunnel to site_B

site_B to site_A-tunnel

Now if at site B ISP1 goes down

route to site A with metric 10 automatically removed from routing table and traffic switches to ISP2 tunnel.

At site A same thing happens, primary tunnel route removed from routing table and traffic automatically switch to secondary tunnel.

When ISP1 at site B comes back up, traffic automatically fails back to the primary tunnel.

Simples