Skip to main content
FortiMilan
FortiMilan
New Member
May 1, 2025
Solved

How to Configure Redundant IPsec Tunnels over SD-WAN Links

  • May 1, 2025
  • 2 replies
  • 4293 views

Hello Fortinet Community,

I have a setup with two WAN connections that are part of an SD-WAN virtual interface. On each of these WAN links, I’ve configured a site-to-site IPsec VPN tunnel to a remote location. The phase 1 and phase 2 settings for both tunnels are identical, except for the WAN interface used.

 

My goal is to achieve redundancy between these two IPsec tunnels—so that if the primary tunnel goes down, traffic automatically fails over to the secondary tunnel. Could anyone guide me on how to properly configure this redundancy within the SD-WAN framework? Should I use performance SLAs, specific SD-WAN rules, or routing strategies? 

 

Any detailed guidance or configuration examples would be greatly appreciated.

 

 

Thanks in advance!

Best answer by jiahoong112

Yes, this can be achieved using sdwan. Ensure both of these ipsec tunnels are configured with sdwan rules and performance sla so that failover works seemingly. 
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-IPsec-VPN-with-SD-WAN/ta-p/209840 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Add-an-existing-IPsec-VPN-tunnel-to-SD-WAN/ta-p/282186 

Another way to go about this is to configure 'set monitor' on the secondary ipsec tunnel so that it monitors the primary tunnel. Once the primary tunnel goes down as detected by dpd, the secondary tunnel will come up. You can control how fast the failover happens by changing tweaking the dpd settings: https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-VPN-Site-to-Site-tunnel-monitor/ta-p/190643 

2 replies

jiahoong112
Staff
jiahoong112Answer
Staff
May 1, 2025

Yes, this can be achieved using sdwan. Ensure both of these ipsec tunnels are configured with sdwan rules and performance sla so that failover works seemingly. 
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-IPsec-VPN-with-SD-WAN/ta-p/209840 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Add-an-existing-IPsec-VPN-tunnel-to-SD-WAN/ta-p/282186 

Another way to go about this is to configure 'set monitor' on the secondary ipsec tunnel so that it monitors the primary tunnel. Once the primary tunnel goes down as detected by dpd, the secondary tunnel will come up. You can control how fast the failover happens by changing tweaking the dpd settings: https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-VPN-Site-to-Site-tunnel-monitor/ta-p/190643 

    FortiMilan
    FortiMilanAuthor
    New Member
    May 2, 2025

    Thank you for your response regarding Adding an existing IPsec VPN tunnel to SD-WAN.

    Unfortunately, I’m unable to remove the tunnel from the active references, as doing so will cause a service interruption between sites. I believe the simplest solution would be to configure set monitor on the secondary IPsec tunnel.

    jiahoong112
    Staff
    jiahoong112
    Staff
    May 2, 2025

    You may opt to use link-monitor as well: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Link-Monitor-Explained/ta-p/197504

    it behaves similarly to sdwan's performance sla

      hokunmo1
      hokunmo1
      New Member
      May 1, 2025

      Lets say I don't have a need at many of the spokes to do any performance based VPN tunnel selection. They would strictly be active/backup all the time, and, in some instances, I may want to force certain traffic over the backup tunnel all the time. Does using the BGP based config you reference give me any benefit over doing it with just static routes + PBR and setting distances accordingly?

      Terms & ConditionsAccessibility statement