Hub and spoke with 4 interfaces

[Satory]

We have a Data center (DC) and a Central Location (HQ).

For a redundancy we have 4 separate lines:

- 2 are direct leased lines, which I want to use for a primary connection;

- 2 are trough Internet and I would like to use them as a backup connection.

I have implemented the IPSec between all points and I am using BGP.

The question is how to achieve maximum bandwidth usage and redundancy in the same time?
Should I:
1. Use IPSec aggregate or SDWAN on the primary and secondary interfaces?

2. How to make sure the secondary is used only in case secondary goes down? In my current setup I tried to use BGP with communities, but still there is traffic on all interfaces.

3. I have to add move remote locations with, each with one primary and one backup line. If I put them into the same SDWAN, whenever the primary goes down the packets are sent to the other members in the same SDWAN, is this a normal behavior? 

[Julien87 · Accepted solution]

Hi Satory,

The policyr rules are configured in zone sdwan destination. You don't use interface name. It's more simple.

For the priority in the SDWAN member, i think this link will interested you.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Assigning-Priority-to-SD-WAN-Members-for-D... 

If you have multiple link, SDWAN will simplify your configuration.

Best regards,

[Satory]

Will try this in Monday and will give a feedback :)