Best practice for HA RAVPN

[CyberFortiConquer]

We currently have a pair of FortiGates that would need configured for IPSEC Remote Access VPN.

We have 2 separate ISP connections and active route is driven by BGP.

Can you please advise what is best practice to configure HA for remote VPN clients and how can it be achieved?

Currently, I have 2 separate VPNs off the firewall links configured by adding Secondary IP to the links.

However I want the user to connect to a single VPN and dynamically connect to active one.

We use VDOMs and current version is 7.2.

If we do create a loopback, using the floating IP --> 100.100.100.100, which the ISP links secondary IP pointing to 100.100.100.101 and 100.100.100.102.

Thanks

[Atul_S]

If your WAN IPs are dynamic, you can configure DDNS for both WAN links or use separate DNS entries (e.g., vpn1.abc.com and vpn2.abc.com). Once that is done, configure two separate IPsec VPN tunnels, one for each WAN connection. For the local gateway, either use wan static IP or DDNS you configured above.

After this, configure your FortiClient with Multiple Gateways. No need to make any changes on the BGP side. However, if you choose to use static routes then in that case you need to adjust the priority value to make sure one link acts as primary all the time and failover should take place.

In case you still want to use secondary IP on each WAN link and plan to have two different remote vpn profiles for variety of users, then its best you reach out to your system engineer for your account within Fortinet so that the design aspect can be assessed in detail.

You may refer the doc https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-DDNS-for-SSL-VPN/ta-p/194137 for reference only. This doc is for sslvpn but idea is the same for DDNS.

I hope this helps.

Thanks

[CyberFortiConquer]

Thanks for your response.

I currently have the same setup with 2 VPN profiles. We have static WAN IPs.

However, from end user perspective, how will that work? If primary link fails, how will the user switch automatically to secondary since there are 2 profiles to connect to the VPN. We wanted it to be dynamic failover with user not having to connect to another profile manually.

[Atul_S]

Hi,

Kindly refer https://community.fortinet.com/t5/FortiClient/Technical-Tip-Multiple-gateway-IP-for-FortiClient/ta-p... as reference. 

I hope this helps.

Thanks,

[CyberFortiConquer]

Thanks, that's great option.

When I tested that with Server option, since we wanted routing to control the failover rather than Ping response.

The client however tries both tunnels - for instance proposals don't match for Gateway1 it will try Gateway2.

Is there a way to stop trying all VPNs if proposals fail?

[Atul_S]

Hi,

If we have multiple gateways configured in FortiClient, then it will try and connect using round robin for each gateways. We cannot stop the connection attempt if the proposal fails for the 1st VPN while you are having multiple gateways

[Atul_S]

Hi,

By default, FortiClient tries the gateways in the order they are listed (priority-based method, TCP RTP timer). The best option would be to ensure that all gateways have matching proposals to avoid this issue. If you are using EMS based Forticlient then its best to create a ticket for the TAC to look at the EMS settings to see if we can achieve the desired result.

Thanks

[CyberFortiConquer]

Thanks again.

If we do create a loopback on Fortigate for these tunnels and then point the users to this loopback IP, can this be achieved?

[Atul_S]

Hi, Yes, we can create a loopback and point the individual WAN IP to the loopback using VIP if you are using private IP for your virtual interface. I would suggest doing the setup in your lab environment using loopback with a private IP. Create two instances of IPsec and 2 VIP and ipv4 policies accordingly and then define multiple gateways in your Forticlient using static IP. Please reach out to your system engineer if you need help wth this design as I am sure there will be a few more items that need to be taken care of.

Thanks,