Technical Tip: How to configure the VRRP VIP as the local VPN gateway address

[epinheiro]

Description	This article describes how to configure the VRRP IP address as the local VPN gateway address. The IP address of a VPN gateway is usually the IP address of the network interface that connects to the Internet, but it can also be changed. The existing setup is not affected by the VPN settings.
Scope	VRRP VIP, IPsec, VPN, Phase1, Site-to-Site VPN, local VPN gateway, peer.
Solution	Check the VRRP VIP by executing the following command 'get router info vrrp': On the local FortiGate, modify the phase1 settings using GUI: On the CLI: If using a policy-based tunnel: config vpn ipsec phase1      edit "SiteA"          set interface port1          set local-gw 192.168.63.200 end If using a route-based tunnel: config vpn ipsec phase1-interface      edit "SiteA"          set interface port1          set local-gw 192.168.63.200 end On the remote FortiGate, point the remote gateway to the VRRP VIP instead of the physical interface IP: IPsec Monitor on the local FortiGate: IPSec Monitor on the remote FortiGate: