IPSec one hub multiple spokes with a single phase 1

Question

Hello,

I have a headquarters site with a FortiGate firewall.

We also have multiple secondary sites across the country. Each remote site normally uses its primary ISP connection ( through MPLS) to access the corporate network.

Our goal is the following:

If a remote site loses its primary ISP link,
We plug in a Starlink connection at that site,
The site should automatically establish an IPsec tunnel (IKEv2) to the headquarters,
All traffic (0.0.0.0/0) should be routed through the tunnel to HQ (full tunnel), so the site can continue to access the corporate network and internet through HQ.

The tunnel requirements:

IPsec with IKEv2
Full tunnel
Starlink uses dynamic public IP

My question:

Is it possible to configure a single Phase 1 and Phase 2 configuration on the HQ FortiGate that can accept connections from all remote sites (with dynamic IP addresses), or do I need to create one Phase1/Phase2 pair per remote site ?

What I find difficult to accept from a design perspective is the idea that I would need to create one Phase 1 configuration per remote site, especially since we have a large number of sites. From a scalability and operational standpoint, maintaining dozens of nearly identical Phase 1 entries at HQ seems heavy and not very elegant.

Ideally, I would prefer:

One dial-up Phase 1 on HQ
Multiple remote peers connecting to it
Differentiation based on Peer ID or similar mechanism

Is this achievable in FortiOS?
If not, what is the recommended scalable design for this type of architecture?

tunnel(1).png

dker · Accepted Answer

Hi, months later i should edit this thread because i found the real problem and wanted to help people’s facing the same issue.

The issue was the “local subnet” configured in the client’s IPsec Phase II selector.
Although Fortinet often recommends using 0.0.0.0/0 as the traffic selector, this does not work with dial-up topologies.
In a dial-up VPN, the client must advertise a unique real subnet, because the FortiGate use the Phase II selector to identify and differentiate the tunnel (peer/tunnel ID).
Using 0.0.0.0/0 on all clients prevent FortiGate from properly matching the Phase II SA to the correct dial-up tunnel.

Hope it helps ! Cheers

funkylicious · Answer

you could, following the example of a Hub and spoke configuration used in ADVPN but not using ADVPN per-say, with the hub being a dialup server.

you would also need a dynamic routing protocol like BGP or OSPF to advertised the default route to the hub.

this would be a example, don't know for sure if it will work 100% as it is, you might need to test it in a lab.

HUB:  config vpn ipsec phase1-interface edit "Hub-VPN" set type dynamic set interface <> set ike-version 2 set peertype any set net-device disable set proposal <> set add-route disable set dpd on-idle set dhgrp 14 set psksecret <> set dpd-retryinterval 20 set dpd-retrycount 3 next end  config vpn ipsec phase2-interface edit "Hub-VPN" set phase1name "Hub-VPN" set proposal <> set dhgrp 14 set replay disable set keepalive enable next end  config system interface edit "Hub-VPN" set vdom "root" set ip HUBIP/32 set allowaccess ping set type tunnel set remote-ip UNUSEDIP/24 next end    SPOKE: config vpn ipsec phase1-interface edit "to-Hub" set interface <> set ike-version 2 set peertype any set net-device enable set proposal <> set add-route disable set localid "Branch<>" set dpd on-idle set dhgrp 14 set remote-gw <HUB_WAN_IP> set dpd-retryinterval 20 set dpd-retrycount 3 set idle-timeout enable set idle-timeoutinterval 5 set psksecret <> next end  config vpn ipsec phase2-interface edit "to-Hub" set phase1name "to-Hub" set proposal <> set dhgrp 14 set replay disable set auto-negotiate enable next end  config system interface edit "to-Hub" set vdom "root" set ip SPOKEIP/32 set allowaccess ping set type tunnel set remote-ip HUBIP/24 next end

Afterwards you need to configure BGP or OSPF using those tunnel IPs and of course firewall rules.

Sign up

Login with SSO

Login to the community

Login with SSO