Skip to main content
James_G
James_G
New Member
April 17, 2019
Question

SD-WAN redundant routing question

  • April 17, 2019
  • 4 replies
  • 4285 views

I have a high level question if a scenario is possible.

 

I have 2 main head office sites, with a traditional MPLS link connecting the 2, lets call them site A and site B, each site also has a leased line for internet access. Each site has a 300D HA pair for corporate firewall.

 

I also have remote offices with a DSL internet connection and VPN connectivity to site A, using Fortigate 60E DSL.

 

Is it possible to configure resilient VPN connectivity / SD-WAN so that if the internet leased line to site A fails, the remote office can still access resources on site A, via VPN to site B and across MPLS?

 

Each site has unique internal address, lets say 10.1.x.x/16 for site A, 10.2.x.x/16 for site B and 10.3.x.x/16 for remote site, the routing on the MPLS forwards traffic for 10.3.x.x/16 to site A, as traffic is expected to route from this firewall / VPN endpoint, traffic from site B to remote site is required so I can't change MPLS routing.

 

It's all a bit blue sky thinking right now, wondering if anyone has done the same.

    4 replies

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    April 17, 2019

    I'm not sure how SD-WAN fits in your situation while FGT's SD-WAN is mainly focusing on multiple/redundant connectivity & monitor/control for Cloud-resources. I don't have any experience how it would control traditional VPN traffic&redundancy over it. Somebody else might be able to answer.

     

    But your situation is a traditional dynamic routing situation. What we do for that kind of situation (actually that's our business) is to set up dynamic routing protocol, specifically eBGP among all three locations over MPLS connectivity including VPNs so that we can manipulate preference one path over the other using communities, which we can't do with OSFP.

     

    But if you haven't dealt with any routing protocol and strictly been using static routes, I would set two static routes for the same destination like 10.3/16 with different distance or priority to both VPNs. When the primary site-A VPN comes down, the secondary site-B VPN route would be used. 

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    April 18, 2019

    Actually that covers only one direction. You also need to set another set of static routes with different distance or priority to get back to the remote location from the Site-A: one toward the direct VPN for primary, and another toward Site-B for secondary.

    That's the reason we use BGP. It's automatic.

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    April 18, 2019

    And, of course, Site-B needs to have a static route for the remote location toward the VPN.

     

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!