Configure IPSec with SD-WAN and Interaction with OSPF

[thUnknown]

Hi,

Sorry if the following question is a stupid one. I recently took over the management of our FortiGate's, so all of this is pretty new to me. 

We currently have a hub and spoke architecture with our HQ handling the connections between all of our remote sites. We have site-to-site IPSec VPN connections with each of our branch offices. Our HQ has two individual ISP links.

We use OSFP as our primary routing protocol.

We've recently been experiencing an issue with one of the ISP links in our HQ and that is impacting some of these site-to-site connections.

I wanted to introduce redundancy, establishing IPSec connections on both the HQ's WAN interfaces for each branch and I know our previous administrator was looking into implementing IPSec VPN with SDWAN to achieve this. Each branch would have connections back to the HQ on both WAN1 and WAN2 interfaces, so if either is disrupted, the branch site would not lose access.

It should be noted that some sites on a single ISP connection and some have 2+. I will need to deal with these different scenarios.

While reading through the documentation and watching videos, I am getting stuck on a few points, the main one though being the creation of the static routes for the local LANs that are behind the FortiGate at each respective site - Configure IPsec VPN with SD-WAN - Fortinet Community

If we were to go the SDWAN route, are the static routes absolutely required?

If the static routes are required, what is the impact to our underlying OSPF?

And I am assuming I would need to create a ton of static routes to ensure that the sites could probably communicate with one another via HQ?

Is SD-WAN the right solution for what I am trying to accomplish? Is it possible without a major overhaul?

Thank you

[Toshi_Esumi]

Although I might not be the expert of OSPF while I mainly deal with BGP every day, I can at least tell you whatever the routing protocol is, it's design to handle multiple paths for the same destination (prefix) and fail over when a path is down. So if you have OSPF in place throughout your network, it should already be redundant either you use ECMP or prefer one IPsec over another under normal cercumstances. If it's not working when you lose one ISP link (all IPsecs over it), something is wrong with OSPF topology. 
On the other hand, you need SD-WAN if you need to/want to one type/application of traffic to use one path while other traffic to the same destination to use another path, which routing protocol is not designed to do. 

I recommend you fix the failover situation with OSPF first, then consider implementing SD-WAN to split traffic between two parallel routing options based on traffic type. At that time, you have to set ECMP to have both routes in RIB. Otherwise, SD-WAN can't route traffic to the path if there is no valid route to that direction in RIB.

Toshi

[thUnknown]

Thank you for your reply.

I do not think this is necessary the fault of our OSPF, it think it mainly due to the fact that at the moment we only have single IPSec tunnels connecting to our branch sites. I don't think my previous colleagues had considered establishing multiple connections and then relying on the OSPF for the redundancy.

I will investigate this option.

Thank you.

[princes]

Hi,

If you need both tunnels to be up at the same time and want to choose a specific one to route the traffic then you might use route map to prioritize a specific OSPF route.

In case you need to do a load balance and both of the IPSEC tunnels should forward the traffic then BGP would be a better option here for ADVPN with SDWAN.

However you can still use OSPF as you mentioned you have few branches .

You might also consider the point where you have single ISP , in this case you can utilize IKEv2 with network ID feature .

Kindly refer the below admin guide it if helps :

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/677459/advpn-with-ospf-as-the-routing-pr...

Thank you.