Hub and Spoke SDWAN? (remote and local IP on vpn)

[userzer0]

Hey all,

I'm struggling with something super simple. I'm working through the "Hub and spoke SD-WAN deployment example" in the admin guide, trying to set one up in real life.  Some of the configuration elements, specifically the local and remote IPs on the tunnels is throwing me for a loop though.

in the admin guide, on the hub side, (on each tunnel interface) they're using an IP for the hub's tunnel interface IP and then a /24 network for the remote-ip:

config system interface
edit "vpn-isp-a"
set vdom "root"
set ip 10.254.0.1 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.254.0.254 255.255.255.0
set interface "port2"
next
edit "vpn-isp-b"
set vdom "root"
set ip 10.254.1.1 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.254.1.254 255.255.255.0
set interface "port3"
next
end

But on the spoke side they're using a completely different set of IPs on each tunnel interface, with a /32 for the remote-ip:

config system interface
edit "vpn_dc1-1"
set vdom "root"
set ip 10.255.0.2 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.255.0.1 255.255.255.255
set interface "port2"
next
edit "vpn_dc1-2"
set vdom "root"
set ip 10.255.1.2 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.255.1.1 255.255.255.255
set interface "port3"
next
end

Can someone explain to me how this works?

Thanks in advance!

[gfleming]

If your hub and majority of spokes will eventually have dual WANs then keep the hub with two tunnel interfaces in separate subnets. Just tie them to WAN1 for now.

I would also keep it simple and just map WAN1 tunnel to remote WAN1 tunnel and WAN2 tunnel to remote WAN2 tunnel.

https://docs.fortinet.com/document/fortigate/7.2.0/sd-wan-architecture-for-enterprise/242149/ipsec-o...

[arie_arie]

Hi,

I'm interested with this topic.

At first, I have 1 hub and 1 spoke with IP as below:

Hub local IP: 10.90.0.1/32

Hub remote IP: 10.90.1.254/23

Spoke1 local IP: 10.90.0.2/32

Spoke1 remote IP: 10.90.0.1/23

From hub can ping to spoke1 local IP. When I add new spoke, both spoke1 and spoke2 local IP can't be pinged from hub.

Spoke2 local IP: 10.90.0.3/32

Spoke2 remote IP: 10.90.0.1/23

Then I tried to change the spoke remote IP to become /32 as below:

Spoke1 local IP: 10.90.0.2/32

Spoke1 remote IP: 10.90.0.1/32

Spoke2 local IP: 10.90.0.3/32

Spoke2 remote IP: 10.90.0.1/32

But still the hub can't ping to spoke1 and spoke2 local IP.

If 1 spoke is disconnected, then the hub can ping the 1 remaining spoke.

Why does the hub can't ping to spoke local IP when there are more than 1 spokes active?