Skip to main content
Mirza_Asad2723
Mirza_Asad2723
New Member
November 29, 2023
Question

Immediate IPsec VPN Primary & Secondary Failover

  • November 29, 2023
  • 4 replies
  • 9969 views

Hi Team,

 

I am facing an issue that our some services are cloud based like SAP and i have two WAN links in my FortiGate so that's why I configured two IPsec VPN connections (primary & secondary by using two different WAN links) between Cloud and our FortiGate. I used "Set Monitor" command for failover in secondary IPsec VPN configuration which will monitored primary IPsec VPN connection. I set the two static routes for accessing cloud based server, 1st static route is set for access cloud based server via Primary IPsec VPN connection with AD value is 10 and the priority value is 1, and the 2nd static route is set for access cloud based server via secondary IPsec VPN connection with AD value is 10 and the priority value is 10 to use route when primary down. After that both IPsec VPN connections are working fine and properly auto failover but the issue is that this failover takes few seconds to shift the traffic from primary to secondary which causes our users will disconnect from their established connection from cloud based SAP service. I want to configure this failover will occur immediately without any delay to prevent disconnection issue from cloud based SAP service. Please guide what can i do and how to check failover threshold and is it edible.

 

FortiGate Model: 201F

Firmware Version: 7.0.10 build0450

4 replies

hbac
Staff
hbac
Staff
November 29, 2023

Hi @Mirza_Asad2723,

 

Do you have those tunnels under an SDWAN zone? 

 

Regards, 

    Mirza_Asad2723
    Mirza_Asad2723Author
    New Member
    November 30, 2023

    No, These tunnels are not in the SD-WAN zone.

    xshkurti
    Staff
    xshkurti
    Staff
    November 29, 2023

    @Mirza_Asad2723  

    It seems like you are not using SD-WAN but monitor link with link-monitor to update static routes if any change ocures.

     

    Please try to implement sdwan because it has much better results for your requirements. It can also be adjusted based on your needs.

     

    Technical Tip: Configure IPsec VPN with SD-WAN - Fortinet Community

     

    Regards,

      Mirza_Asad2723
      Mirza_Asad2723Author
      New Member
      November 30, 2023

      Hi Concerns,

       

      Is there any alternative to SD-WAN? Making a lot of changes for SD-WAN requires me to wait for downtime. It can't be adjusted through CLI by changing the threshold or check interval. If I set the priority of the secondary route from 10 to 2, will it work? Because two routes are defined, one with AD=10 & Priority=1, and the secondary route with AD=10 & Priority=10. Both routes have the same AD value, only the Priority value is different. Please suggest if this is possible and beneficial.

       

      Further thanks to share your suggestion. 

      Mirza_Asad2723
      Mirza_Asad2723Author
      New Member
      November 30, 2023

      can I configure settings to immediately change if, for example, there are 2 ping drops or if the latency becomes too high without disconnecting any sessions. something likewise

      hbac
      Staff
      hbac
      Staff
      November 30, 2023

      @Mirza_Asad2723,

       

      When using 'set monitor', the secondary tunnel will remain down until the primary goes down and it will take a few seconds for the secondary tunnel to be negotiated and up. 

       

      You can use link-monitor instead. Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-Link-monitor/ta-p/197504

       

      Regards, 

        Mirza_Asad2723
        Mirza_Asad2723Author
        New Member
        December 1, 2023

        @hbac 

         

        Are you suggesting using 'set monitor' along with 'link-monitor'? Can both be used simultaneously without any conflicts? Because, as per my understanding, both serve a similar purpose. Additionally, to the best of my knowledge, 'set-monitor' doesn't shift to the secondary link until the primary link is down. Link-monitor, on the other hand, not only monitors link status but also examines latency and packet loss. If there is significant latency or packet loss, it considers the primary link as down and activates the secondary link. Am I correct in my understanding?

         

        Please confirm.

        pbangari
        Staff
        pbangari
        Staff
        December 1, 2023

        You can try 'unset monitor' under IPSec configuration and use link-monitor instead as in this case both the primary and secondary tunnels will be up and traffic failover should happen much quicker.

        https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-VPN-Site-to-Site-tunnel-monitor/ta-p/190643

         

         

          Terms & ConditionsAccessibility statement