Skip to main content
maiconp340
maiconp340
New Member
March 4, 2020
Solved

Two Dialup VPN actives

  • March 4, 2020
  • 8 replies
  • 10696 views

Hello,

On my Branch office I need stablish two active Dialup VPN with my HQ.

On my HQ I have two ISPs Internet links and at the my BR only one.

At the Fortigate on BR I have set Two Dialup client to ISP1 and ISP2 for HQ.

My problem is never two tunnels is UP at the same time, when one come up other to Down.

I wonder if is possible to keep active the two tunnels Dialup at the same time on client side.

 

follow the configuration on two box, version is 6.0.9. please disregard psk and peerid

 

#HQ VPN Dialup server Config config vpn ipsec phase1-interface edit "Dialup-MGT" set type dynamic set interface "INTERNET-MGT" set mode aggressive set peertype one set mode-cfg enable set proposal 3des-md5 aes128-md5 set dpd disable set nattraversal disable set peerid "c.c.c.c" set assign-ip disable set psksecret fffff next edit "Dialup-EQX" set type dynamic set interface "INTERNET-EQX" set local-gw t.t.t.t set mode aggressive set peertype one set mode-cfg enable set proposal 3des-md5 aes128-md5 set dpd disable set nattraversal disable set peerid "ffff" set assign-ip disable set psksecret next end

#HQ VPN Dialup server Config phase 2

config vpn ipsec phase2-interface edit "Dialup-ph2" set phase1name "Dialup-MGT" set proposal 3des-md5 aes128-md5 set src-addr-type name set dst-addr-type name set src-name "all" set dst-name "all" next edit "Dialup-ph2-eqx" set phase1name "Dialup-EQX" set proposal 3des-md5 aes128-md5 set src-addr-type name set dst-addr-type name set src-name "all" set dst-name "all" next end

#BR VPN Config phase 1

config vpn ipsec phase1-interface edit "Dialup-ctl" set interface "INTERNET" set local-gw x.x.x.x set mode aggressive set peertype any set mode-cfg enable set proposal 3des-md5 aes128-md5 set localid "h.h.h.h" set dpd disable set nattraversal disable set remote-gw y.y.y.y set assign-ip disable set psksecret hhhhh next edit "Dialup-eqx" set interface "INTERNET" set mode aggressive set peertype any set mode-cfg enable set proposal 3des-md5 aes128-md5 set localid "g.g.g.g" set dpd disable set nattraversal disable set remote-gw t.t.t.t (DIFFERENT FROM Dialup-ctl ) set assign-ip disable set psksecret bbbbb next end

 

#BR VPN CONFIG PHASE2

config vpn ipsec phase2-interface edit "dialup-ph2-ctl" set phase1name "Dialup-ctl" set proposal 3des-md5 aes128-md5 next edit "dialup-ph2-eqx" set phase1name "Dialup-eqx" set proposal 3des-md5 aes128-md5 next end

 

Best answer by Toshi_Esumi

What is your goal with those two parallel VPNs? Failover or load-balance?

The direct problem is you're trying to bring up two [network selectors: 0/0<->0/0] IPsec vpns. It's not allowed (or possible) without  "set add-route disable" in phase1 config. That's it would be dropped when the second tunnel comes up.

Depending on the goal and the version of FortiOS, how to accomplish routing through two (or one at a time) would be different in addition to "net-device enable/disable" setting with phase1-int config.

8 replies

Toshi_Esumi
SuperUser
Toshi_EsumiAnswer
SuperUser
March 4, 2020

What is your goal with those two parallel VPNs? Failover or load-balance?

The direct problem is you're trying to bring up two [network selectors: 0/0<->0/0] IPsec vpns. It's not allowed (or possible) without  "set add-route disable" in phase1 config. That's it would be dropped when the second tunnel comes up.

Depending on the goal and the version of FortiOS, how to accomplish routing through two (or one at a time) would be different in addition to "net-device enable/disable" setting with phase1-int config.

maiconp340
maiconp340Author
New Member
March 5, 2020

Hello, my goal is load balance with SD-WAN, after that two VPNs Dialup come up at the same time they go are under SD-WAN Interface so Fortigate will do load balance Traffic regard SLA.

maybe you wonder yourself why I don´t use Site-to-Site IPsec, it´s the issue, I can´t because I have 140 Branch with 3 Links each so I overcome interfaces member under SD-WAN ( 256 is the limit ) and my target is load balance with SD-WAN.

I will do more some test and report here.

 

Thanks, with you have any other idea or doc about SD-WAN with Dialup VPN please post here.

 

 

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
March 5, 2020

SD-WAN shouldn't care the type of circuits in the members (at least its design). If you are running 6.2.x, "IPsec aggregate" is the easiest load-balancing method between two tunnels. Still need to bring up two tunnels though.

Terms & ConditionsAccessibility statement
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!