How to Setup IPSEC VPN with Dual ISP Connections?

[Kevin_Noble]

I have searched the forums and Knowledge Centre but cannot find the exact answer I am looking for. I have two different offices on different ISPs that also use the Fortigates for IPSEC VPNs to encrypt taffic back to the main office (again different ISPs at the main office that I want to match on the remote side) - from what I have found so far I think this requires some careful interface definitions with proper distance numbers, some type of load balancing and policy routes - does anybody have an example. I don' t need any automatic failover or anything - I just want both interfaces to be available and to make sure I can properly route the VPN tunnels to connect to the proper ISP' s network. I think the biggest thing I need is an example of a policy route that would work in this situation. Our default route on the FGT-400 points to our internal network and up until the addition of the second ISP interface we just setup static routes to the ISP connections at the remote ofifces because all we are doing is using the Internet as a conduit for the VPN connection. I made the mistake of hooking up the second ISP (which happended to be a ADSL connection) today and ended up causng problems with the existing SP interface since the routing got all messed up - I have seen in the forums others have had similiar experiences and the setup required to make things work is a little more complex than what one first expects. The text outline below kind of describes what we have. Remote office #1 - FGT60 -----IPSEC VPN Tunnel ---- ISP #1                                                                                     \ - FT-400 - Main Network Remote Office # 2 - FGT60 -----IPSEC VPN Tunnel ----ISP #2 / Can anybody provide any details on the steps to set this up?

[FortiRack_Eric]

Basically what you need to do is: Set up equal metric, dual wan connection, with the priority on the main wan connection. Setup 2 interface mode connections tie one to wan1 and the other to wan2. Then you get to virtual interfaces one below wan1 and the other on wan2. add routing to remote segments via the virtual interface. Next is to set fw rules. Done. Succes, Regards, Eric