How to create dial-in IPSEC VPN with 2 wans for failover redundancy

[ejellis]

I've been searching and searching on the best way to do this.  I need to configure redundant dial in IPSEC VPN for FortiClient users.  Meaning If WAN1's internet is down WAN2 will kick in and work Just like in an SD-WAN failover situation.  I have not been able to find a clear answer on a config to do this.  I know how to implement SD-WAN over IPSEC in a site to site config but there doesn't seem to be a clear config for dial in users using Forti Client.  Any help is appreciated.

[funkylicious]

i think that a failover/backup ipsec dialup configuration would be kinda hard to achieve, unless the same public subnet would be available through both WANs/ISPs.

if so, i think that you could create a loopback interface used in IPsec config and create VIP for UDP/500 and UDP/4500 towards it using a public IP that could be reached from both connections.

[ejellis]

I've looked into that as well and the only downside to it is you lose hardware acceleration using a loopback interface.    I wish it was  as easy as it is with SSL VPN where you set it to listen to both WANs in the setup.   Since SSL VPN is going extinct I've got to find a better solution

[funkylicious]

maybe try using a fqdn as remote gateway having a dns entry for both wans / having 2 ipsec tunnels configured, one for each interface

L.E. something like described here, https://docs.fortinet.com/document/forticlient/7.4.3/ems-administration-guide/622574/load-balancing-... 

[ejellis]

This is the way I will most likely go as our customers have FQDN DNS records for VPN its already in place 

[Toshi_Esumi]

For FGT side, you just need to set up two "dialup" IPsecs with two different interfaces.
For the client side, you need to list two different remote gateway addresses then let the Forticlient try the first one until it fails and fails over to the second one.

Toshi

[Toshi_Esumi]

If you put two IPsec interfaces into one zone, you don't have to duplicate policies.

Toshi

[ejellis]

Thanks for the great input everyone.  I will give this a try in my lab.  I think I was over thinking this a bit.  I will give an update once I've completed testing

[ejellis]

Not having any luck with both gateways in the forti-client.  I have configured VPN's for both WAN's  and can connect to both individually.  Simulating one going down it never attempts to connect to the second gateway. Times out and does not connect .