|
Scenario:
- IPsec interface for internet access is used.
- These IPsec interfaces are members of the SD-WAN link.
- Monitor health-check of these 2 IPsec interfaces for SD-WAN performance SLA is aimed.
Simple diagram:
Users are behind subnet 192.168.100.0/24 with gateway 192.168.100.1 (FortiGate LAN interface).
Both IPsec interfaces are up.
The SD-WAN health-check (called: ipsec_check):
SpokeB (sdwan) # show health-check ipsec_check
config health-check
edit "ipsec_check" -> ping probe to server 1.1.1.1
set server "1.1.1.1"
set members 0 -> all members ipsec_1 & ipsec_2
next
end
These are confirmed to be dead those are up.
SpokeB (root) # diagnose sys sdwan health-check
Health Check(ipsec_check):
Seq(1 ipsec_1): state(dead), packet-loss(100.000%) sla_map=0x0
Seq(2 ipsec_2): state(dead), packet-loss(100.000%) sla_map=0x0
By default, the IPsec site-to-site interface has no IP address:
- The overlays do not have an IP address assigned to them. Therefore, FortiGate uses the address of the interface with the lowest index number as the source address
SpokeB (root) # show system interface ipsec_1
config system interface
edit "ipsec_1"
set vdom "root"
set allowaccess ping https ssh snmp http fgfm
set type tunnel
set snmp-index 22
set interface "port7"
next
end
SpokeB (root) # show system interface ipsec_2
config system interface
edit "ipsec_2"
set vdom "root"
set allowaccess ping https ssh snmp http fgfm
set type tunnel
set snmp-index 23
set interface "port9"
next
end
There are 2 workarounds available that it is possible to choose to solve this problem.
Alternative 1:
- Define IP address on each IPsec interface – by default, IPsec site-to-site has no IP address. However since the ping mechanism needs an IP address to work properly, so the reachability can be acknowledged.
This IP should be reachable from the partner IPsec node. In this case, use '10.100.10.1' for ipsec_1 and '10.100.20.1' for ipsec_2. 'Remote IP' is a dummy IP - it is not necessary to assign it to any interface.
SpokeB (root) # show system interface ipsec_1
config system interface
edit "ipsec_1"
set vdom "root"
set ip 10.100.10.1 255.255.255.255
set allowaccess ping https ssh snmp http fgfm
set type tunnel
set remote-ip 10.100.10.2 255.255.255.252
set snmp-index 22
set interface "port7"
next
end
SpokeB (root) # show system interface ipsec_2
config system interface
edit "ipsec_2"
set vdom "root"
set ip 10.100.20.1 255.255.255.255
set allowaccess ping https ssh snmp http fgfm
set type tunnel
set remote-ip 10.100.20.2 255.255.255.252
set snmp-index 23
set interface "port9"
next
end
To check the IP address used for performance SLA:
SpokeB (root) # get router info kernel 17
tab=254 vf=0 scope=0 type=1 proto=17 prio=0 10.100.20.1/255.255.255.255/0->1.1.1.1/32 pref=0.0.0.0 gwy=10.100.20.2 dev=23(ipsec_2)
tab=254 vf=0 scope=0 type=1 proto=17 prio=0 10.100.10.1/255.255.255.255/0->1.1.1.1/32 pref=0.0.0.0 gwy=10.100.10.2 dev=22(ipsec_1)
- Set source IP address used by health-check. In this case, use 192.168.100.1 -> IP address of FortiGate LAN interface. This IP should be reachable from the partner IPsec node.
SpokeB (members) # show
config members
edit 1
set interface "ipsec_1"
set source 192.168.100.1
next
edit 2
set interface "ipsec_2"
set source 192.168.100.1
next
end
The source IP can also be set on the health check directly (Starting with v7.2.0):
config system sdwan
config health-check
edit <name>
set source 192.168.100.1
next
To check the IP address used for performance SLA:
SpokeB (root) # get router info kernel 17
tab=254 vf=0 scope=0 type=1 proto=17 prio=0 192.168.100.1/255.255.255.255/0->1.1.1.1/32 pref=0.0.0.0 gwy=0.0.0.0 dev=22(ipsec_1)
tab=254 vf=0 scope=0 type=1 proto=17 prio=0 192.168.100.1/255.255.255.255/0->1.1.1.1/32 pref=0.0.0.0 gwy=0.0.0.0 dev=23(ipsec_2)
Now, health-check detects the status of the interfaces correctly:
SpokeB (root) # diagnose sys sdwan health-check
Health Check(ipsec_check):
Seq(1 ipsec_1): state(alive), packet-loss(0.000%) latency(2.696), jitter(0.116) sla_map=0x0
Seq(2 ipsec_2): state(alive), packet-loss(0.000%) latency(2.793), jitter(0.393) sla_map=0x0
Related articles:
Technical Tip: Configure IPsec VPN with SD-WAN
Technical Tip: Use of 'link-monitor' to detect IPsec ESP (IPsec payload) being blocked
Technical Tip: SD-WAN enhanced health check options
|
