Explorer

Question

FG-70F to able to support two IPsec VPN in active active mode via different ISP

5 replies
2107 views

Need to understand if the FG-70F in my hand can be able to support two IPSEC VPN via WAN interfaces connected to two different ISP in active active mode (with load balancing).

This is branch and at central side we have other FG with different model but same motive.

Please let me know how is it possible to implement this.

FortiGate

ajoy

Staff

Hello,

Are you able to provide more information. Like a topology, are these members part of SDWAN zone.

Please check the following article for redundant :

https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/432685/manual-redundant-vpn-configuration

You can definitely check by unsetting monitor main_VPN in the documentation

 set monitor main_vpn

Regards,

ajoy

mayur07pAuthor

Explorer

Hi Ajoy,

In our case the two sites are geo separated (different country) for example HQ1 in India and HQ-2 in USA is this solution feasible?

Toshi_Esumi

SuperUser

If you want simply load-balance between two paths and don't want to manipulate much, I would recommend IPsec Aggregate below:
https://docs.fortinet.com/document/fortigate/7.2.9/administration-guide/779544/packet-distribution-and-redundancy-for-aggregate-ipsec-tunnels

Toshi

mayur07pAuthor

Explorer

Hi Toshi,

LB with different internet link (different BW) will work in this case?

if yes then its good for me

Toshi_Esumi

SuperUser

It doesn't matter what kind of internet circuits those are as long as each has reachability to the other end.

Toshi

Sign up

Login with SSO

Login to the community

Login with SSO