Skip to main content
posemman
posemman
New Member
January 15, 2021
Question

IPSec-VPN Backup Line on MPLS connection

  • January 15, 2021
  • 2 replies
  • 9767 views

Hi all

 

Do you have any idea on how to set-up IPSec-VPN connection(on fortigate) as a back-up line on existing MPLS?

Including also the automatic failover?

 

 

 

    2 replies

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    January 15, 2021

    That's depending on how traffic is routed through MPLS now. If everything is static, you need to have higher cost/distance static routes on the IPSec side for the same destinations. But if it's learning routes via routing protocol, generally need to use the same protocol over the IPSec but adjust some metrics not to prefer the backup side.

    If static, you likely need to set link-monitor to detect a disconnection to the destination over MPLS and remove the primary static route.

    posemman
    posemmanAuthor
    New Member
    January 18, 2021

    Hi Toshi,

     

    Thank you for your answer.

    Our MPLS use EIGRP routing protocol, is it possible to fortigate to use EIGRP?

     

    posemman
    posemmanAuthor
    New Member
    April 22, 2021

    Hi, I would like to ask assistance on below issue

     

    We set-up policy base ipsec vpn on (HQ)fortigate 300c v5.2.15 and on (RO)Fortigate 60E v5.6.11 for MPLS backup. The tunnel is up and traffic is flowing on both site.  HQ local network: 172.27.14.0/24 Remote Local: 172.27.80.10/32 - This is client device, to only pass thru IPSEC    Then the static route on HQ is: 172.27.0.0 255.255.0.0 to Internal Core Switch(MPLS connection)              > AD of 20 Priority of 0 172.27.80.10 255.255.255.255 IPSEC to REMOTE              > AD of 20 Priority of 1 0.0.0.0 going to (Public internet)              > AD of 10 Priority of 0 -------------------------------------------------------------------------- Then the static route on RO is: 172.16.0.0/12 to router(MPLS connection)             > AD of 10 Priority of 0 172.27.14.0/24 to IPSEC to HQ             > AD of 10 Priority of 1 0.0.0.0 going to (Public internet)             > AD of 5 Priority of 0   Ping and traceroute from RQ(172.27.80.10) to HQ - RESULT GOOD 1 <1 ms <1 ms <1 ms 172.27.80.254 2 * * * Request timed out. 3 10 ms 9 ms 11 ms 172.27.14.25   The issue is the other network device(172.27.1.2) pinging from RQ having intermittent connection(at least 10 packet drops) then it will up again and re occur again. This network is not included in IPSec set-up, so I don't know why it is affected when IPSEC tunnel is up.   Do traceroute from RO going to 172.27.1.2 when intermittent occur: 1 <1 ms <1 ms <1 ms 172.27.80.254 - (FG gateway) 2 <1 ms <1 ms <1 ms 172.27.253.245 - (Router IP of RO) 3 7 ms 7 ms 8 ms 172.27.253.129 - (HQ MPLS Tunnel ip) 4 * * * Request timed out. 5 * * * Request timed out. 6 * * * Request timed out.

    posemman
    posemmanAuthor
    New Member
    January 18, 2021

    Since we are using EIGRP on MPLS, and fortigate is not compatible on it.

    Is it advisable to create additional static route as a countermeasure for IPSec VPN backup line set-up?

     

    1. Keep Existing main routing(EIGRP)

    2. Create new route(static route) to each sites with higher administrative distance.

     

    May I know your input on this if its good design?

    Yurisk
    SuperUser
    Yurisk
    SuperUser
    January 18, 2021

    As EIGRP is not supported by Fortigate, it means you have your MPLS terminating on equipment that does support EIGRP (Cisco), so EIGRP and its routing is of no interest/concern to the Fortigate.

     

    I see 2 possible scenarios here:

    - You have say 2 connections on Fortigate - one to Cisco that itself connects to MPLS and runs EIGRP (or may run anything, as said - no business of FGT), and another to the ISP/Internet over which you bring up IPSec VPN. What is left is:

    [ul]
  • Have in Fortigate 2 static routes to the remote network, one via Cisco/MPLS and another via IPSec VPN tunnel interface auto-created when you configured the VPN. You want to set different priority for routes accordingly to the way you want to reach the remote network.
  • Decide how you want Fortigate to detect failure of one of those 2 connections. Link-monitor would do the trick by using, e.g. ping to detect when a link fails.[/ul]

    - Second scenario is to let go of the static routing in Fortigate, set up dynamic routing between Cisco of MPLS and Fortigate, say OSPF, redistribute EIGRP routes to OSPF process on Cisco which will advertise them to Fortigate, run dynamic routing protocol in Fortigate over the IPsec VPN with the remote VPN peer (actually optional, but then you have to configure link-monitor and lose benefit of dynamic routing in detecting the link failure), set dynamic protocols routes policy on Fortigate to prefer MPLS or IPSec path to reach the remote network, congratulate yourself on making it through and knowing that only you can support all this :) (just kidding, it is not that complex)

     

    HTH

     

    • Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    January 18, 2021

    By the way, it's obvious but don't forget you do whatever you choose in Yuri described on both ends. Both sides need to move to the backup path at the same time and fail-back too.

    Terms & ConditionsAccessibility statement