FGSP Dynamic Tunnel VPN in SD-WAN

[arie_arie]

Hi,

I need advice regarding using FGSP in dynamic tunnel VPN in SD-WAN.

I read the admin guide below:

https://docs.fortinet.com/document/fortigate/7.2.8/administration-guide/892338/fgsp-per-tunnel-failo...

And I have question if I'm using dynamic IP for the tunnel and I have 2 FGTs in FGSP, do I need use different subnet in each FGT or I can use the same subnet?

Thanks

Ari

[AEK]

Hi Arie

The question is not clear, can you please elaborate?

[arie_arie]

Hi,

In FGCP FortiGate, I can create dial-up VPN tunnel in the hub and add start-ip and end-ip for dial-up client to retrieve an IP address.

For example:

config vpn ipsec phase1-interface

edit "Tunnel-1"
set type dynamic
set interface "port1"
set ike-version 2
set authmethod signature
set net-device disable
set mode-cfg enable
set proposal aes256-sha256 aes256gcm-prfsha256
set add-route disable
set dpd on-idle
set dhgrp 19
set auto-discovery-sender enable
set network-overlay enable
set network-id 1
set certificate "Tunnel-Cert"
set tunnel-search nexthop
set ipv4-start-ip 192.168.32.11
set ipv4-end-ip 192.168.39.253
set ipv4-netmask 255.255.248.0
set dpd-retryinterval 5
next

end

Because of FGCP sync between 2 FortiGate devices in a cluster so that I can use same dynamic start-ip , end-ip and subnet.

How about 2 FortiGates in FGSP,  do I need to separate subnet between FortiGate? Or can I use same subnet on both FortiGates?

[AEK]

Hi Arie

I didn't try it but it seems for me more logical that it works if the 2 FGs share the same network but different ranges, for example like that:

1st FG

set ipv4-start-ip 192.168.32.11
set ipv4-end-ip 192.168.35.255
set ipv4-netmask 255.255.248.0

2nd FG

set ipv4-start-ip 192.168.36.0
set ipv4-end-ip 192.168.39.253
set ipv4-netmask 255.255.248.0

If you try it thanks to share if it works.