Configuring a backup IPSec tunnel using the 'monitor' command

[FatalHalt]

Hey guys,

I have a box which I'm building a site-to-site tunnel on. The remote site has two locations, and my box should be able to 'fail' to the second location if the primary is unreachable.

From what I understand, this should be as simple as creating a phase 1 for each location, and using the 'set monitor "primary-phase-1"' on the secondary tunnel - like this:

config vpn ipsec phase1-interface
    edit "Primary"
        set interface "wan1"
        set nattraversal disable
        set comments "To Primary Location"
        set dhgrp 5
        set remote-gw XX.XX.XX.XX
        set psksecret ENC xxxxxxxxxxxxxxx
    next
    edit "Secondary"
        set interface "wan1"
        set nattraversal disable
        set comments "To Secondary Location"
        set dhgrp 5
        set remote-gw XX.XX.XX.XX
        set monitor "Primary"
        set psksecret ENC xxxxxxxxxxxxxxx
    next
end

That seems pretty straight-forward. But when I go to set up my static routes - do I just set up both of them the same? Do I need to weight the primary higher than the secondary? 

Thanks

[FatalHalt]

Anyone have any insights here?

Thanks

[ede_pfau · Accepted solution]

The secondary will not be "up" until the primary VPN fails. If you point two identical routes (same distance, same prio) to Primary and Secondary, the FGT will load-balance (cf. ECMP) the traffic - which will lead to 50% packet loss.

So you need to apply identical distances but a higher prio ("priority" == "cost" in FortiOS) to the secondary route. That'll do.

(and of course 2 sets of policies, or one set of policies to a zone made up of the 2 VPN interfaces).

[FatalHalt]

ede_pfau wrote:

So you need to apply identical distances but a higher prio ("priority" == "cost" in FortiOS) to the secondary route. That'll do.

Perfect - I figured it must need to be weighted, thanks for confirming!