Site to Site VPN to 2 Fortigates which are Behind LoadBalancer

Forum|Forum|2 years ago
April 23, 2024
4 replies
2038 views

Hello everyone,

I have a Active/Active Forigate firewalls behind a load balancer in Azure environment, so my External load balancer has only 1 public IP. my question is that how my on-premise fortigate firewall can establish a Site to Site VPN??

When I configure the Site2Site VPN on Fortigate-A everything is fine but as soon I configure Fortigate-B, the tunnel goes down!!!!!!!!!!!!!!!

Thanks,

A

FortiGateCloud

hbac

Staff

Hi @alihmp2005,

If FortiGate-A and FortiGate-B are in HA active-active, you only need to configure VPN on the primary and it will synchronize to the other.

Regards,

alihmp2005Author

New Member

Hi hbac,

Thanks for your answer but they are not in HA cluster, both of them are active and ELB distribute the traffic.

hbac

Staff

@alihmp2005,

So you are load balancing traffic to two FortiGates which are not in HA. That doesn't make sense to me. When creating IPsec tunnel when FortiGate A and B, you need to select 'This site is behind NAT'. On prem FortiGate, select 'Remote site is behind NAT' and enable the following options:

config vpn ipsec phase1-interface
edit <name>
set net-device enable
end

config vpn ipsec phase2-interface
edit <name>
set route-overlap allow
end

Regards,

Sign up

Login with SSO

Login to the community

Login with SSO