Technical Tip: How to deploy dial-up IPsec VPN in SDWAN using BGP routing

[SassiVeeran]

Description	This article describes the steps to set up an SD-WAN dial-up VPN using BGP routing.
Scope	FortiGate.
Solution	This article will explain and show the configuration example for Dial-UP IPSec VPN in the SD-WAN scenario. To understand the site-to-site IPSec VPN in an SDWAN scenario with a configuration example the following article can be reviewed: Technical Tip: Configure IPsec VPN with SD-WAN. Objective: Dial-up IPsec VPN connection between two FortiGates. Using two ISPs to establish VPN connections between each other for the same sites. In this example, Port1 is used for DialupServer1(Primary) and Port5 is used for DialupServer2 (Secondary). A similar setup is configured for DialupClient. In this example, DialupServer is 10.185.0.0/20 and DialupClient is 10.162.0.0/20. Both tunnels should be active and redundancy or failover should be steered by the SD-WAN rule. The requirement is that, when the DialupServer1 tunnel is down, traffic should routed via the DialupServer2 tunnel. Eventually, when DialupServer1 is alive, traffic should be forwarded back via the DialupServer1 tunnel which is selected by the SD-WAN rule. Below are the configuration steps: Create a VPN overlay tunnel in SD-WAN for both the dial-up server and dial-up client FortiGates. The output should be as below: VPN settings: DialupServer1 and DialupServer2 should be similar: DialupClient1 and DialupClient2 should be similar: BGP routing: Dial-up Server: Dial-up Client:                                        Create a default static route for SD-WAN/Overlay tunnel on the FortiGates at both ends. Create an address group for the phase2 selector in DialupServer1 & 2 VPN FortiGate. The local address group includes the local network, DialupServer1 & 2 tunnel IP (with mask /32). The remote address group includes the remote network, DialupClient1 & 2 tunnel IP (with mask /32). Configure the same on the DialupClient1 and DialupClient2 FortiGate VPNs. SD-WAN rule: Create an SD-WAN rule to steer the traffic on the FortiGates at both ends. VPN tunnel interface: Firewall Policy: Create a firewall policy for the VPN tunnel in and out of FortiGate on both ends. Final output: