| Description | This article provides a step-by-step guide on configuring an aggregate IPsec tunnel interface using the GUI on FortiGate. |
| Scope | FortiGate. |
| Solution |
Configuring an aggregate IPsec tunnel involves combining multiple IPsec tunnels into a single logical interface, which distributes traffic across the member tunnels for improved performance and redundancy. This describes the necessary steps to set up an aggregate IPsec tunnel for both WAN interfaces on this site to the same remote site.
In the diagram below, there are two WAN interfaces on this FortiGate and multiple IPsec tunnels to a single site from both WAN interfaces to a single remote gateway.
To configure an aggregate IPsec tunnel interface:
It is possible to assign a descriptive name, and there will be four options for the algorithm.
Both tunnels are pointing toward the same remote gateway. If it is desired to add both the tunnels to the aggregate interface, it will be necessary to remove all the references to the IPSEC tunnels and to enable the ‘set aggregate-member’ in the IPsec phase1 setting in CLI, by default it is disabled. Once enabled, it will be available to add.
Once both IPsec tunnels are available, it is possible to add them to the Aggregate interface as shown below.
Once both IPsec tunnels are added to the aggregate interface, they will be referenced under the aggregate interface as shown below.
It will be necessary then to configure a firewall policy for this new aggregate interface from the internal interface to the aggregate tunnel interface, as shown below.
By following these steps, it is possible to successfully configure an aggregate IPsec tunnel using the FortiGate GUI, enhancing the redundancy and performance of the VPN connections.
Note: If the following errors appear while enabling 'aggregate-member' on an existing Dialup tunnel, the workaround is to delete the tunnel and recreate it through CLI with the 'aggregate-member' option enabled at the same time.
Note: Starting from FortiOS 7.0 (the FortiOS version where the IPsec kernel was re-designed), a static route over an aggregate tunnel will fail to remove its static route from the routing table even when all the members of the aggregate tunnel are down (this applies to the case of a single or floating static route over the aggregate tunnel). The DEV team has acknowledged this issue; however, it will not be fixed. So, other means (workaround) have to be deployed when facing this issue.
working scenario (6.2/64): when aggregate 'tun_to_slc_ag2' is DOWN.
NON-working scenario (v7.0 and above): the failed aggregate tunnel 'tun_to_slc_ag2' remains installed in the routing table.
Workaround: The aggregate tunnel can be added to the SD-WAN zone, and then a performance SLA should be configured over the aggregate tunnel to a remote server. Once the remote server is no longer reachable over the SD-WAN, the rule that forwards traffic over the aggregate tunnel will fail, and FortiGate to stop using the affected (down) aggregate tunnel.
Related article: |
