Multiple VPN (ipsec) To Same Destination

Forum|Forum|4 years ago
June 9, 2022
4 replies
18535 views

Hi Team,

I have configured 2 IPSEC to the same remote destination and it was working fine with version 6.4 however after the upgrade it stopped working. The reason for that is that the Tunnel ID for the second tunnel is assigned with an IP of 10.0.0.1 and not the public IP (which is assigned to the first IPSEC). Apparently, there is a behavior change on version 7.2. (In general, tunnel IDs are assigned the IP address of the remote gateway. If multiple tunnels use the same gateway IP address, then a random IP address from the subnet 10.0.0.0/8 is assigned).

Has anyone encountered a similar issue and what is the recommended fix?

Appreciate your help and assistance.

FortiGate

paulistic

Staff

I've had issues after upgrading to 6.4 - but I suspect that was because the return traffic would go through the other tunnel - resulting in RPF fail. Check the exact path of the packets on the far end.

sw2090

SuperUser

hm it works here in 6.4.9 with 0.0.0.0/0.0.0.0 as p2 selector and prio/distance based routing and policies.

So traffic pimarily hits the tunnel with the lowest routing prio/distance and if that were down it would hit the next one.

kanes39Author

New Member

Hi Gents,

Thanks for the reply.

This was absolutely fine with version 6.4 but now on 7.2 this is an issue.

The 2nd tunnel to the same peer is getting assigned a 10.0.0.1 tunnel ID and that is getting translated into the routing table and when tunnel 2 becomes active traffic GOES nowhere. If I cannot find a solution might need to downgrade the firewall. Got it working now by reducing the AD of the 2nd VPN tunnel route and forced it to the first tunnel.

pminarik

Staff

In 7.0.1+ there was a change which binds IPsec-tunnel routes to a "tunnel ID". It looks like an IP, but from my current understanding it actually isn't.
Here's a page documenting the change in behaviour - https://docs.fortinet.com/document/fortigate/7.0.0/new-features/649094/dedicated-tunnel-id-for-ipsec-tunnels-7-0-1

If you believe that this is messing with your routing, please strongly consider opening a case with the TAC to review the situation. (before you downgrade, so that they can gather any necessary debugs)

kanes39Author

New Member

Hi @Networkman ,

This was actually not a fault but more of a feature changes.
We did not have to fix it, we reset the route table and it was able to use both the links although the public IP was different.