How routing for underlay interfaces should be configured?

[mcegielka]

Hi all,

I'm experimenting on v7.2.11 with ADVPN, SD-WAN and BGP on loopback interfaces. My problem is that I can't understand or find information on how the underlay interfaces routing should be configured. Two or four IPSec tunnels are members of the overlay SD-WAN zone (both branch and HQ use two Internet uplinks). The tunnels are configured on different physical interfaces and should be active all the time, so encrypted packets should go out through the respective interfaces to the specified addresses. A default route through one interface, of course, won't do. Should there be two/four routes to 0.0.0.0/0 through all interfaces with the same distance? Or should there be another SD-WAN zone containing the underlay interfaces? But in the latter case, won't SD-WAN steer all encrypted packets through one "best" physical interface?

While I'm at this routing question, I would also like to ask another, simpler one: when configuring a site-to-site VPN without split tunnel, I have to set a default route through that tunnel interface. To connect to the IPSec peer, I manually add a route to that peer’s public address. What would happen if I wanted to use a DDNS name? I would not know the IP address of the peer beforehand. Is there a way to configure such a VPN?

Best regards,
Mariusz

[jiahoong112]

As you require all 4 wan link of yours to be active at the same time, they should all have the same Admin Distance but different Priority value. The smaller the Priority value, the higher the routing Priority. As you are using SDWAN, best to put all the 4 wan links into an SDWAN Zone (separate or same is up to you) and change the Priority value from there. 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Assigning-Priority-to-SD-WAN-Members-for-D... 

You may find this helpful: https://docs.fortinet.com/document/fortigate/7.6.0/sd-wan-sd-branch-architecture-for-mssps/151899/ba... 

https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/820072/advpn-with-bgp-as-the... 

Refer here for ipsec site to site with ddns:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-VPN-between-static-and-dynamic-IP-FQ... 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Use-DDNS-for-an-IPsec-dial-up-connection-f... 

[mcegielka]

Hi @jiahoong112 ,

that's what I do not understand: why set route priority if I need each IPSec to exit its own assigned interface? But thanks for links to these articles.

As of  IPSec with DDNS I did not find any information about routing to peer in these articles.

[sakebma2]

Add your ipsec tunnel to the sdwan zone that has your primary and secondary wan interfaces. Create an manual selection sdwan rule that prioritizes interfaces by the order you select them. Create a perf sla that pings a server reachable over the public internet (we typically use Google 8s and Cloudflare 1s) and check the "update static route" option.