Technical Tip: Configuring multiple Site-to-Site IPsec VPNs between the same gateway IP address

[fwilliams]

Description	This article describes how to configure multiple site-to-site IPsec VPN tunnels between the same VPN gateways, ie, the same local and remote IP addresses. FortiGate supports this requirement through the use of a Fortinet proprietary IKEv2 attribute called network-id, which allows multiple concurrent IPsec tunnels to coexist between identical peer IP addresses without conflict.
Scope	FortiGate v6.4, v7.2, v7.4, v7.6.
Solution	In some deployment scenarios, administrators may need to establish multiple IPsec tunnels between the same pair of FortiGates using the same remote gateway IP addresses. This configuration can be useful for simplifying firewall policy design, traffic separation, or applying different security profiles per tunnel. Configure the first IKEv2 IPsec tunnel with the required parameters, such as encryption, authentication, pre-shared key (PSK), or certificates, as per the deployment requirements. In CLI phase 1 configuration, enable the 'network-overlay' option and specify a unique 'network-id'. The 'network-id' must be identical on both VPN peers to successfully establish the tunnel. config vpn ipsec phase1-interface edit "<phase1-name>" set network-overlay enable set network-id < Minimum value: 0 Maximum value: 255 > next end Repeat for each additional required IPsec tunnel. Sample topology: network overlay Sample phase 1 configuration:This example uses hostnames for the tunnel configuration; however, IP addresses may also be used. FortiGate-A: config vpn ipsec phase1-interface edit "A-B_10" set type ddns set interface "wan1" set ike-version 2 set network-overlay enable set network-id 10 set remotegw-ddns "vpn2.example.com" next edit "A-B_20" set type ddns set interface "wan1" set ike-version 2 set network-overlay enable set network-id 20 set remotegw-ddns "vpn2.example.com" next end FortiGate-B: config vpn ipsec phase1-interface edit "B-A_10" set type ddns set interface "wan1" set ike-version 2 set network-overlay enable set network-id 10 set remotegw-ddns "vpn1.example.com" next edit "B-A_20" set type ddns set interface "wan1" set ike-version 2 set network-overlay enable set network-id 20 set remotegw-ddns "vpn1.example.com" next end Duplicate IKEv1 site-to-site tunnels are not supported. Related articles: Technical Tip: Use case of Network-IDs with ADVPN shortcut tunnels Technical Tip: FortiGate Hub with multiple IPSec Dial-up phase1 using IKEv2 and PSK authentication