Explorer

Solved

Multiple IPsec tunnels between head and branches, using SDWAN

Forum|Forum|2 years ago
July 25, 2024
8 replies
4340 views

Hello,

I am implementing a scenario where I will have a headquarters and several branches, connected through IPSec tunnels.

In the headquarters firewall I will have a fixed public IP address and in the branches I will have internet links with dynamic IP addresses (CGNAT and LTE/4G).

I need to connect two IPsec tunnels per branch with the headquarters, one tunnel for each WAN and I need to use SDWAN to control this traffic and define the SLA for each tunnel.

I already have this working format using IPsec SDWAN, where I create 1 tunnel for each link.

However, at headquarters, I only have one WAN interface and I use it in all tunnels with branches. Could this cause me some kind of problem? I've already noticed that when I make a change on the matrix side in a tunnel, it momentarily "drops" the connection in the other tunnels.

What is correct on the head office side, considering that I only have 1 WAN interface, is to have 1 tunnel for each branch?

Today I have 1 tunnel for each branch link, for example, branch 1 has two WANs, so I have an IPsec tunnel for WAN1 and another IPsec tunnel for WAN2, and so on. Always using FQDN because the public IP is dynamic on the branch side.

My question is whether this configuration I am using is recommended for this connection format.

vpn fortinet.png

Best answer by TSTelecom

Everything indicates that applying the "set replay disable" configuration in the phase2-interface of the tunnels resolved the problem.

kaurs

Staff

Hello,
From the description, topology looks good. You are already using sdwan so that will take care of tunnels redundancy. And it is normal to have multiple tunnels on the HQ side as well.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-FortiGate-SD-WAN-with-an-IPSEC-VPN/ta-p/190756

TSTelecomAuthor

Explorer

Hello,

Thanks for your answer!

The scenario works correctly, except for the fact that instabilities occur in the Performance SLA when I make any changes to another existing tunnel, but I am carrying out other tests to better understand this behavior.

SonaMuvv

Staff

Hello,

Could you please specify what kind of changes are you making on the tunnel that is causing the instability in SLA.

Also you can view 10 minute history of SLA logs in CLI and monitor the behavior:

diagnose sys sdwan sla-log PingSLA 1

https://docs.fortinet.com/document/fortigate/7.0.15/administration-guide/943037/monitoring-performance-sla

rishab444

Staff

Hello @TSTelecom ,
What are you using under your performance SLA ? its is sometimes better to use loopback interfaces as they are more stable.

You might need to run a sniffer for source and destination and see what side is actually causing the problem.

#dia sniffer packet any 'host <source IP> and host <destination IP>' 4 01

rishab444

Staff

Hello @TSTelecom,

If you make any changes on WAN of the hub that could cause interruption, it is always going to impact the other tunnel as its also part for same WAN.

Setting IP on the tunnel interface can also assist in these scenarios.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-Tunnel-ID-expected-behavior/ta-p/240429

TSTelecomAuthor

Explorer

Hello,

Thank you for your suggestion, I will apply the IP address to the tunnel interface and monitor the behavior.

Answering the other question, yes, I use Performance SLA to monitor the connection, I use it on both sides and on both sides I monitor the Fortinet interface on the remote end.

Is it correct to use Performance SLA at the headquarters and branch? Or would it be ideal to only use it at the branch?

TSTelecomAuthorAnswer

Explorer

Everything indicates that applying the "set replay disable" configuration in the phase2-interface of the tunnels resolved the problem.

Sign up

Login with SSO

Login to the community

Login with SSO