How to Configure Redundant IPsec Tunnels over SD-WAN Links

[FortiMilan]

Hello Fortinet Community,

I have a setup with two WAN connections that are part of an SD-WAN virtual interface. On each of these WAN links, I’ve configured a site-to-site IPsec VPN tunnel to a remote location. The phase 1 and phase 2 settings for both tunnels are identical, except for the WAN interface used.

My goal is to achieve redundancy between these two IPsec tunnels—so that if the primary tunnel goes down, traffic automatically fails over to the secondary tunnel. Could anyone guide me on how to properly configure this redundancy within the SD-WAN framework? Should I use performance SLAs, specific SD-WAN rules, or routing strategies? 

Any detailed guidance or configuration examples would be greatly appreciated.

Thanks in advance!

[jiahoong112 · Accepted solution]

Yes, this can be achieved using sdwan. Ensure both of these ipsec tunnels are configured with sdwan rules and performance sla so that failover works seemingly. 
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-IPsec-VPN-with-SD-WAN/ta-p/20984... 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Add-an-existing-IPsec-VPN-tunnel-to-SD-WAN... 

Another way to go about this is to configure 'set monitor' on the secondary ipsec tunnel so that it monitors the primary tunnel. Once the primary tunnel goes down as detected by dpd, the secondary tunnel will come up. You can control how fast the failover happens by changing tweaking the dpd settings: https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-VPN-Site-to-Site-tunnel-monitor/ta-p... 

[FortiMilan]

Thank you for your response regarding Adding an existing IPsec VPN tunnel to SD-WAN.

Unfortunately, I’m unable to remove the tunnel from the active references, as doing so will cause a service interruption between sites. I believe the simplest solution would be to configure set monitor on the secondary IPsec tunnel.

[jiahoong112]

You may opt to use link-monitor as well: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Link-Monitor-Explained/ta-p/197504

it behaves similarly to sdwan's performance sla

[hokunmo1]

Lets say I don't have a need at many of the spokes to do any performance based VPN tunnel selection. They would strictly be active/backup all the time, and, in some instances, I may want to force certain traffic over the backup tunnel all the time. Does using the BGP based config you reference give me any benefit over doing it with just static routes + PBR and setting distances accordingly?