FG90D - WAN LLB + Site-to-Site IPSEC VPN + RA VPN IPSEC

[misterpimpa]

Hello,

Need your professional advise on following.

I'm using Fortigate 90D with 5.4.1 as an external FW for filtering Internet traffic and VPN connections.

My FW is configured for using 2 WAN links from 2 different ISP. FW is configured with 2 static routes for Internet access, the only difference in routes is priority and administrative distance. And 2 identical sets of ipv4 policies.

We are also using WAN1 for remote access VPN for user and site-to-site VPN.

Recently we faced a problem with ISP service interruptions - (ping and dns fails).

So I created WAN LLB, wan status check rule, recreated static route, totally reconfigured IPv4 policies for using wan-llb-interface.

Internet access works.

Site-to-Site VPN works - there was a problem with a preshared key. Re-typed from both sides and it was OK.

RA VPN doesn't work. Error message is "Preshared keys do not match". Tried also to retype the key. Doesn't help.

So generally I need a balanced Internet connection with http health check and redundant remote access vpn.

I was thinking about WAN LLB for Internet and 2 identical vpn sets configured for different (wan1 and wan2) interfaces.

What would you advise?