IPSEC Interface Mode Failover from LAN via STP?

[pkley]

Confused exactly how to configure this. Office FGT 60 is 192.168.254.251/0 with a WAN connection Resort FGT 60 is 192.168.254.250/0 with a WAN connection I have a wireless bridge connecting the two firewalls on the LAN side making them on the same subnet with only the Office set for DHCP. Since the wireless bridge may go down, I want to set up a VPN across the WAN as a failover. Can I have both firewalls on the same subnet and accomplish this? Or do I have to have different subnets so that the traffic routes correctly?

[ede_pfau]

That' s exactly the point. A VPN is not a bridging connection but a routed one. Configure an independent subnet for each firewall and set up a static route to the remote one (one route per FGT) using the WiFi bridge port. Set up a second static route with the same destination using the WAN port. Same distance but higher cost (which translates to " lower priority" ). Depending on your version of FortiOS you may have to set the priority in the CLI. Now that both routes are configured check the actual routing table in ' Router' >' Monitor' . There should only be one active default route if done right - namely the route across the WiFi link. If the WiFi link fails the WAN route is revealed and becomes active. You may read up on this topic in the FortiOS Handbook, chapter ' Adv. Routing' . The keyword is ' ECMP' . If you' re really using the original FG60 model you' re confined to FortiOS 3.00. Check the Release Notes for the minimum version when ECMP was introduced. If you can use v3.00 MR7 patch10 you' re on the safe side. P.S. for robustness I' d set up a DHCP server on each FG.