Skip to main content
ck8882
ck8882
Explorer
April 7, 2023
Solved

OSPF over SDWAN dual IPsec connect to DC FGT with non SDWAN ipsec aggreation interface

  • April 7, 2023
  • 1 reply
  • 3336 views
HI, May i know does it support OSPF over SDWAN IPSEC - Spoke (with two tunnel IP) to Non SDWAN - Hub (with one single IP and aggregate-member enable) . I notice the once of the ospf interface is process stuck in INIT state. it's like no way for  Remote FGT (Non SDWAN) connect Local FGT (Spoke) tunnel 2 IP.
Diagram like below
 
Local FGT (Spoke)<------> Remote FGT (Non SDWAN)
Tunnel1 -------Aggregate1 port1
Tunnel2 -------Aggregate1 port2
 
Local FGT tunnel 1 and 2 using different IP
Aggregate1 port1 and port 2 share single same IP
 
Due to SDWAN migration phase timing separately deploy for 2 site, so need  any workaround or idea can be solve scenario above

 

Please help if there is good idea. Thanks

 

Best answer by gfleming

Your IPSEC Aggregate interface is set to redunant mode. This means it will only use first tunnel that is up for all traffic.

 

Still even so I would suggest moving away from aggregate interface and use two separate tunnels for this. And then use OSPF over each tunnel to maintain reachability.

1 reply

gfleming
Staff
gfleming
Staff
April 8, 2023

In FortiGate, SD-WAN is a local construct. You can create an SD-WAN rule so that Tunnel1 and Tunnel2 are participating in SD-WAN even though Remote FGT is not configured for SD-WAN.

 

Even so there is no reason why you can't intermix technologies here. Of course you can have some non-SD-WAN links particpating on your firewall outside of your SD-WAN links.

 

I would troubleshoot this just like any other connection.....

 

1. my understanding—could be wrong—is that aggregate ipsec needs the same config on the other end (for example both FortiGates need dual interfaces with separate tunnels) https://docs.fortinet.com/document/fortigate/6.4.4/administration-guide/779544/ipsec-aggregate-for-redundancy-and-traffic-load-balancing

2. Do your IPSec interfaces have IP itnerfaces and connectivity between them (So OSPF can talk )?

ck8882
ck8882Author
Explorer
April 8, 2023

HI gfleming,

 

Thanks for response.

 

I notice one of OSPF interface keep show "INIT" and another is showing "full"

 

I also wondering shall it required aggregate ipsec configured in other end ) Local FGT in sdwan feature. 

For your Q2, yes, there is IP configured in the IPSEC interface in "remote FGT", but just allow 1 IP allow to configured. So the 2 aggregate ipsec is same IP.

 

I wondering would it because remote FGT aggregate ipsec unable point to 2 different remote IP in "local FGT" so that why OSPF flapping cause another ospf interface show "INIT"?

 

If there is the case, would it have any workaround could achieve it? Appreciate anyone share the idea.

 

Below is the sample configuration for diagram above. you may take a look.

 

 

In Remote FGT (Non SDWAN)
config system interface
edit "S2S" <------(IPSEC Aggregate. only allow use Same IP. which under to wan1 and wan2)
set vdom "root"
set ip 10.10.10.1 255.255.255.255
set allowaccess ping snmp
set type tunnel
set remote-ip 10.10.10.2 255.255.255.240


config vpn ipsec phase1-interface
edit "S2S-VPN1"
set interface "wan1"
set peertype any
set net-device disable
set aggregate-member enable

 

edit "S2S_VPN2"
set interface "wan2"
set peertype any
set net-device disable
set aggregate-member enable

 

config router ospf
edit "OSPF_S2S-"
set interface "S2S"
set network-type point-to-point

 

IN Local FGT (SDWAN)
config system interface
edit "S2S-VPN1" 
set vdom "root"
set ip 10.10.10.3 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.10.10.1 255.255.255.240
set snmp-index 15
set interface "wan1"

 

edit "S2S-VPN2"
set vdom "root"
set ip 10.10.10.4 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.10.10.1 255.255.255.240
set snmp-index 14
set interface "wan2"

config ospf-interface
edit "OSPF_S2S-VPN1"
set interface "S2S-VPN1"
set network-type point-to-point

 

edit "OSPF_S2S-VPN2"
set interface "S2S-VPN2"
set network-type point-to-point

 

gfleming
Staff
gfleming
Staff
April 8, 2023

What is the output of "show system ipsec-aggregate" on the Remote FGT?

 

And output of " show vpn ipsec phase1-interface" on the Local?

 

And can you confirm you have IP connectivity between the IPSec tunnels using 10.10.10.1 and 10.10.10.3/.4?

Terms & ConditionsAccessibility statement