Loadbalance messing UP IPSEC_VPN
Hello!
I need help diagnosing loadbalance cousing strange behavior with IPSEC_VPN. I have two IPSEC_VPN configured on ports WAN2 and DMZ with the following configuration:
edit "VPN_HERVAL"
set interface "wan2"
set keylife 28800
set mode aggressive
set proposal 3des-sha1
set localid "stores"
set dhgrp 5
set remote-gw XXX.XXX.XXX.XXX
set psksecret ENC
next
edit "VPN_HERVAL_B"
set interface "dmz"
set keylife 28800
set mode aggressive
set proposal 3des-sha1
set localid "stores"
set dhgrp 5
set remote-gw XXX.XXX.XXX.XXX
set psksecret ENC
next
end
config vpn ipsec phase2-interface
edit "VPN_HERVAL"
set phase1name "VPN_HERVAL"
set proposal 3des-sha1
set dhgrp 5
set keepalive enable
set auto-negotiate enable
set keylifeseconds 1800
set src-subnet 10.12.72.0 255.255.255.0
next
edit "VPN_HERVAL_B"
set phase1name "VPN_HERVAL_B"
set proposal 3des-sha1
set dhgrp 5
set keepalive enable
set auto-negotiate enable
set keylifeseconds 1800
set src-subnet 10.12.72.0 255.255.255.0
next
end
My loadbalance is as follow:
config system virtual-wan-link
set status enable
set load-balance-mode weight-based
set load-balance-quality-mode latency-based
config members
edit 1
set interface "dmz"
set gateway 192.168.0.1
set weight 6
set spillover-threshold 110
set detect-server "XXX.XXX.XXX.XXX"
next
edit 2
set interface "wan2"
set gateway 192.168.25.1
set weight 4
set spillover-threshold 40
set detect-server "XXX.XXX.XXX.XXX"
next
end
end
And my routes are as follow:
config router static
edit 3
set dst 172.16.0.0 255.240.0.0
set gateway 10.252.72.1
set distance 10
set device "wan1"
set comment "Route for Embratel MPLS, has priority over VPN A."
next
edit 4
set dst 172.16.0.0 255.240.0.0
set priority 10
set distance 10
set device "VPN_HERVAL"
set comment "Route for VPN_A, has priority over VPN_B."
next
edit 1
set dst 172.16.0.0 255.240.0.0
set distance 15
set device "VPN_HERVAL_B"
set comment "Route for secundary VPN."
next
edit 5
set virtual-wan-link enable
set distance 10
next
end
Both VPN connect to the same external IP (pointed to another Fortigate). When the primary route goes off-line (static route 3) loadbalance starts to connect and disconnect on both VPN making communicantions impossible do to repeated disconnects and reconnects. Shouldn't load-balance only balance http requests, leaving IP_SEC alone to follow static routes?
Can some one help me? Thanks in advance.
Att.,
