FORTIGATE SDWAN WITH IPSEC OVER MPLS AND DIA

[LorenzoManfrin]

Hi all,

i have 3 branches with MPLS link to HQ and a DIA access.

We have only one ISP that manages two different connections for every branch. The ISP give me the possibility to use the local internet connection as a DIA in every branch. The ISP manages the redundancy of MPLS and internet link between the two different connection they provide.

I want to build an IPSEC tunnel over the MPLS for security reasons and use this also to route some particular internet traffic. In case this link goes down I need to route all the internet traffic through the DIA. I always need the possibility to use the DIA for other traffic.

Branches does not need to talk each other.

This is the network scheme. I only manage fortigates. Routers are managed by the ISP. I've coloured the path that i want to implement.

- Should I use SDWAN to manage that?

- Do I need BGP?

- How do i manage route changes and nat changes?

[Atul_S · Accepted solution]

Hi Lorenzo,

SDWAN would be a wise option to control the traffic traversing IPSEC to HQ and the local Internet breakout point. Since Branches are not supposed to talk to each other, I dont see a point of having a BGP unless the number of LAN prefixes behind each branch and HQ are huge. But having a BGP would be better for scalability and also takes care of the route changes. NAT change for the outgoing traffic will be taken care based on the routing exit gateway and SDWAN.

Please also refer the below docs for your reference as well:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-MPLS-and-IPSEC-tunnel-redundancy-with-link...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Best-practice-when-implementing-SD-WAN-ove...

Thanks,

[LorenzoManfrin]

Hi Atul,

thanks.

I have a lot of lan prefixes behind each branch and I like the idea of more scalability and build a future proof architecture, so I think I'll go with BGP.

By the way I don't have any experience with BGP. Where can I learn something about it related to this architecture?

Thanks.

[syordanov]

Dear LorenzoManfrin,

For basic BGP setup over IPSec , please check the documentation bellow
https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/763341/basic-bgp-example

https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan-sd-branch-deployment-guide/208496/configur...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Dynamic-routing-BGP-over-IPsec-tunnel/ta-p...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-BGP-and-SD-WAN-for-advertising-...

[LorenzoManfrin]

Thanks i'll have it a look.

[Atul_S]

Hi Lorenzo,

You may refer to the videos below for a demo for more understanding. However, pls do validate your configurations before implementation. The links below are for reference only, and I have not verified the content correctness of the video links. The second link will help you understand the BGP concept in detail and I find it very useful.

https://www.youtube.com/watch?v=W7-AlzTJy0s

https://www.youtube.com/watch?v=G0qDnqOKwOE&list=PLvEPp6phNrC-5Pjsb-jHjFXDbEF7NKCGQ

Apart from that, you may refer to the document below as well.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Dynamic-routing-BGP-over-IPsec-tunnel/ta-p...

Thanks,

[LorenzoManfrin]

Thanks Atul, great contents!

I've drawn the final diagram for the network.

Some details aren't clear to me.

I've learnt that I can assign only one router-id to every Fortigate.

Does this router-id need to communicate with other routers id? If so how can i manage that since every tunnel has it's one subnet?

In the diagram I've used the router-id only as an identifier thinking that the communication will be done via tunnel router's addresses. Maybe the "update source" options will help.

Am I wrong?

Thanks.