First time 60E user, need help with SDWAN, VPN please
- August 28, 2017
- 1 reply
- 8009 views
Hi there - I'm setting up the first Fortinet I'd like to use for deploying to about 30 or 40 clinics.
The clinics VPN back to a Juniper SSG firewall in the datacenter.
I am trying to setup:
Failover from WAN1 to the LTE modems (this works using SDWAN perfectly)
Fail back when service returns (this does not work if there is demand on the circuit. If I stop pinging, it will failback as programmed)
VPN tunnel to the datacenter (works but flaps, drops 5 or 10 pings out of 100) on the WAN1 interface with failover to the LTE Modem (failover of the VPN does not work. Phase 1 completes to the datacenter firewall but Phase 2 never does; doesn't even try).
VPN tunnel automatically connects and stays connected after disconnect / power cycle (This does not work - I usually have to click the "bring up" and it connects about 20 seconds after that).
The offices may or may not have NAT in front of the firewall so NAT-T is enabled.
I've attached the config file from the 60E; I removed the default settings to shorten what folks have to look at and sanitized a couple IP's and passphrases with X or x.x.x.x
I would think this would be a pretty common scenario, so if anyone has a working config please let me know. I updated it to the latest firmware since I rarely touch these after deployment unless there's a serious security issue with the firmware itself. Any help greatly appreciated; I've been trying different configurations (primarily with the routing cost and preference, but that didn't really make any difference) for about a week on and off now and just can't get it.
For the fortinet folks - really would suggest you finish the cookbook on SDWAN VPN. If I could tie the VPN tunnel to the SDWAN interface this would be 100x easier.