Two IPSec

Forum|Forum|8 years ago
June 8, 2018
5 replies
4906 views

Hello Guys

I have a design that I requires a two VPN connections from my Office to other offices. Some of the remote offices has same IP subnet like Office 1 has subnet 192.168.10.0 and Office 2 has the same subnet

I want to setup two VPN tunnels to each office. one tunnel will be active and the second one will be standby

Also I want to use PBR with these two IPSec but I am not able to figure out how the routing will be

if I have each office in different subnet i can create two static route (one for each IPSec) and use link monitor to remove the static route from routting table in case first IPSec failed

is there any option PBR in fortigate ?

thanks in advance

Toshi_Esumi

SuperUser

I suggest you follow this thread we had entire today. You seem to have gotten the exact same problem.

https://forum.fortinet.com/tm.aspx?m=162619&tree=true

AbdYAuthor

New Member

Hello Toshi,

Thanks for your feed back

it is almost the same scenario however I have two IPSec tunnels from to each site

the overlap is happening on the remote site and I am wondering if there is a way to use PBR in my case

if the first IPSec tunnel for Office one went down that PBR will not be in use and we will use the second PBR for the second IPSec tunnel (To office one)

Thanks again

Toshi_Esumi

SuperUser

Generally policy route can't be mixed with fail-over because policy won't disappear when interface goes down. However, you don't need policy route as long as you use link-monitor over the primary path and remove static routes bound to the vpn interface when link-monitor goes down. There have been many discussion in the forum about link-monitor you can find or search in on-line help or KB.

ericli_FTNT

Staff

You can configured two phase-1 interfaces as SD-WAN.

Toshi_Esumi

SuperUser

I have a question with the SD-WAN option. How do you specify one side as primary and the other side is secondary, or even better, split them granularly like bsed on destination ip ranges or sub-subnets? If you could post links for any documentation for 5.6 or 6.0 that would be supper!

Thanks,

Toshi

Sign up

Login with SSO

Login to the community

Login with SSO