Configuration Help

[EM_Fortiuser]

I have an HA Firewall in a Active and Passive system. When the system fails over the outbound WAN changes and I need to establish a vpn to the same destination. What is the best solution for this?

I see the cookbook suggestion is SDwan VPN.
https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/389913/dual-vpn-tunnel-wizar...
Just seeing if anyone else has done something like this

[Dhruvin_patel]

Greetings!

To address the issue of outbound WAN IP changes during failover in an Active-Passive HA firewall system and the need to establish a VPN to the same destination, follow these steps:

1. Prevent the phase1-interface configuration sync between the HA members:
- Configure VDOM exceptions to prevent the sync:
```
config system vdom-exception
edit 0
set object vpn.ipsec.phase1-interface
next
end
```

2. Change the local-gw on the passive firewall according to its WAN interface IPs:
- Update the local-gw for each phase1-interface configuration:
```
config vpn ipsec phase1-interface
edit VPN-1
set local-gw <primary private IP>
next
edit VPN-2
set local-gw <secondary private IP 1>
next
edit VPN-3
set local-gw <secondary private IP 2>
next
end
```

By following these steps, you can ensure that both HA members can bring up the IPsec tunnel even after a failover with outbound WAN IP changes. Remember to trigger the failover and test the IPsec tunnels after making these configurations.

Regards!

[EM_Fortiuser]

So I have the configured on different ports for the WAN failover.  i.e. Port 1 for Prod and Port 2 for DR.  Is the exception allowing me to use the same destination from 2 WAN ports. Is best practice to have the wan ports ip on the same interface?