Create 2 Tunnel from 1 device

[papapuff]

I've successful to create ipsec site to site FG-1 to FG-2, with configuration:
FG-1
source local: intf3, ip 10.0.10.0/24
destination local address: 10.0.100.0/24

FG-2
source local address: intf1, 10.0.100.0/24
destination local address: 10.0.10.0/24

now I want to create another tunnel (with same ISP/WAN port:

FG-1
source local: intf4, ip 10.0.20.0/24
destination local address: 10.0.100.0/24

FG-2
source local address: intf1, 10.0.100.0/24
destination local address: 10.0.20.0/24

---
so in summary:

FG1 <--> FG2
10.0.10.0/24 (intf3) <-> 10.0.100.0
10.0.20.0/24 (intf4) <-> 10.0.100.0

FG indicate as fortigate.

kindly please help for best practice and configuration.

thank you

[funkylicious]

hi,

just add a new phase2 selector on the ipsec tunnel, similar with the existing one.

also in terms of routes and firewall policies.

[ede_pfau]

What I usually do when I envision multiple phase2's (say: many), I use wildcard QM selectors in phase2 and leave the security to the policies:

src=0.0.0.0/0

dst=0.0.0.0/0

or rather "unset src", "unset dst" in "conf vpn ipsec phase2-interface".

But for your use case, a quick copy of the existing phase2 in CLI is the easiest way.

[knaveenkumar]

Hi team,

please follow the below document for best practice for ipsec config
https://docs.fortinet.com/document/fortigate/7.6.1/administration-guide/895222/fortigate-to-fortigat...

[papapuff]

hi, thanks for reference, but this only 1 to 1.

and for @ede_pfau 

you get what I need. actually I just created ipsec use wizard.

is it possible to edit and add local address in fg1, and add destination local address in fg2?

-> not working.

here what I've tried:

1. create another ipsec tunnel,

fg1 <-> fg2, with different local subnet.

result: existing tunnel and new going down.

after i delete new tunnel, old tunnel can up again.

2. create new tunnel (without delete the old one):

- FG1

local source: intf2 and intf3, with subnet as above

local remote : 10.0.100.0

- FG2

local source: intf1, with subnet as above

local remote : 10.0.10.0 and 10.0.20.0

result: failed.both tunnel down

[nweckel]

Hello @papapuff ,

please refer to this Technical Tip: Redundant IPSEC Tunnel using single WAN connection with a configuration sample with active/backup IPsec tunnels for a similar topology as yours.

For phase 2 configuration, please remember that the phase 2 selector configured at each end of the tunnel must match to bring the IPsec tunnel UP.

For example:

On FGT1 src: 10.10.10.0/24 dst: 10.10.100.0/24

On FGT2 src: 10.10.100.0/24 dst: 10.10.10.0/24