Partially-redundant IPsec tunnels via different ISPs?

Question

Good day,

I'm trying to understand, if it's possible to make FortiGate, connected by 2 ports to 2 different ISPs, to have parallel 2 VPN tunnels to the same remote gateway - each tunnel via another ISP. The "Partially-redundant route-based VPN example" page seems to explain similar scenario, but here's a detail I miss there:

FortiGate1 has two Internet-facing ports:

[ul]

WAN1, with IP 192.168.10.2 and next-hop of ISP1 is 192.168.10.1.

WAN2, with IP 172.16.20.2. The next-hop of ISP2 isn't mentioned, but let's suppose it's 172.16.20.1.[/ul]

FortiGate2 has single Internet facing port, with IP 172.16.30.1.

The page instructs to configure 192.168.10.1 as default gateway (to 0.0.0.0/0). So IP of FortiGate2 is obviously reached via this next-hop.

Now let's assume that something in ISP1 broke down and the Tunnel1 is down. DPD will detect that, but I see nothing in this configuration that will tell FortiGate1 that now it needs to deliver IPsec packets to the next-hop of WAN2, 172.16.20.1.

There's nothing that can update the routing table of FortiGate1 to tell it that from now on the route to 172.16.30.1 lies via 172.16.20.1.

So how it's going to work?

Thanks,

Vladimir.

Vladimir_Ostrovsky · Answer

I haven't found solution for this meanwhile, but if it's possible to add another address to the remote FortiGate2 (for this example let's say it's 172.16.30.2), then the solution is trivial:

[ul]

configure separate static routes for each remote address, via different ISPs:[/ul]

config router static edit 1 set dst 172.16.30.1 255.255.255.255 set gateway 192.168.10.1 set device wan1 next edit 2 set dst 172.16.30.2 255.255.255.255 set gateway 172.16.20.1 set device wan2 next end

[ul]

configure separate IPsec tunnels to each address, via ports facing different ISPs:[/ul]

config vpn ipsec phase1-interface edit Tunnel1 set interface wan1 set peertype any set proposal aes256-sha256 set dpd on-idle set remote-gw 172.16.30.1 set psksecret ENC encryptedPreSharedKey1 next edit Tunnel2 set interface wan2 set peertype any set proposal aes256-sha256 set dpd on-idle set remote-gw 172.16.30.2 set psksecret ENC encryptedPreSharedKey2 next end

config vpn ipsec phase2-interface edit Tunnel1 set phase1name Tunnel1 set proposal aes256-sha256 next edit Tunnel2 set phase1name Tunnel2 set proposal aes256-sha256 next end

[ul]

wrap them in a common 'zone' object to be used in firewall policies:[/ul]

config system zone edit FortiGate2_zone set interface Tunnel1 Tunnel2 next end

[ul]

Then set up either duplicate static routes, assigning different distances / priorities, over both tunnels to the networks behind FortiGate2 - or set up dynamic routing (e.g. OSPF) with different costs for the two tunnel interfaces. Or assign the same and use ECMP.[/ul]

Now if the (preferrable) tunnel fails, then DPD (or OSPF) will detect that, the logical interface will be marked as 'down', its routes will be removed from the routing table and all traffic will flow via the second tunnel.

Sign up

Login with SSO

Login to the community

Login with SSO