How to configure fully redundant IPSEC VPNs

[pkley]

I followed the guide for a partial (1 WAN FGT to 2 WAN FGT) and set up the ' set monitor-phase-1' to look at the primary phase1. That makes sense and while I haven' t been willing to take down my corp office T1, I' m pretty sure it works. However, the instructions don' t tell you how to do a fully redundant link, which I need to set up between our other two offices that both have dual WANs. I only need one tunnel live, but if either WAN on either end fail, I want it to failover to another tunnel. The problem is the ' monitor-phase-1' only works (as far as I can tell) if you have two possible tunnels, a primary and a secondary. But with dual redundant WANs, there are FOUR possible tunnels. Any thoughts as to how to finish this setup? I have the 4 VPN IPSEC-INTERFACE tunnels set up, the 8 policies (inbound and outbound for each). I have 4 static routes defined with different distances set, but should I be doing differently?

[rwpatterson]

What I would do is put each remote site into a zone. This way you only need one set of rules for each site. If you feel stylish, try using a higher level routing protocol (OSPF, RIP, etc). They may actually see a route down faster [than the FGT itself] and move traffic accordingly.