IPSEC VPN - Remote Site with dual WAN (reduntant modem) - to 110C HA using Dual WAN and Policy Route

[RichardH]

Yes, a very verbose title! I have a 110C HA A-A Cluster with dual ISP' s 1 for VPN and the other for Surfing. All IPSEC vpn tunnels are in Interface mode. I' ve configured a modem on a new 40C to dial out on WAN1 failure and create a IPSEC VPN tunnel. My problem is, my 110C HA is configured using policy routes and depending on the order of policies, the traffic is forced through the first matched rule. Can anyone give me advice how to work around this?

[emnoc]

Can you explain your problem clearly. Are you using a redundant modem to backup one of the ISP1 connection only ? and expecting PBR to work for the other ISP2 connection? A snippet of your PBR and static routing information or example could be beneficial.

[RichardH]

110C - Hub & Spoke IPSEC vpn (interface mode tunnels) - 2 ISP' s, 1 is fibre for VPN tunnels and the 2nd is DSL for surfing - In order to split the traffic for surfing I had to use PBR' s. - I have a PBR for my vpn tunnels so any traffic from inside the branch is passed through the vpn interface then I create a PBR for each service I want to go out my DSL for surfing. 40C - Remote Branch - This remote branch is in Surrey, BC and I' ve had horrible ISP service from the local cable provider. They' re blaming it on " crack heads" climbing the towers to steal the copper wire... I setup a Huawei 4G modem as a redundant backup to WAN1. If WAN1 goes down, the 4G modem should dial out, create a VPN connection to the 110C and start passing citrix and email etc, to the staff. Now, what I' ve done is setup the 40C @ home, in testing I found that the PBR was still trying to push packets out through the VPN interface that was down. It' d be nice if PBR was smart enough to know if an interface was working or not... Static Routes edit 18 set device " VPN_SUR_4G_STA" set distance 100 set dst 192.168.100.0 255.255.255.0 set priority 10 set weight 50 next edit 21 set device " NS_VPN_TEST" set distance 100 set dst 192.168.100.0 255.255.255.0 set weight 50 next PBR edit 23 set input-device " port1" set src 192.168.30.0 255.255.255.0 set dst 192.168.100.0 255.255.255.0 set gateway 10.200.200.50 set output-device " NS_VPN_TEST" next edit 20 set input-device " port1" set src 192.168.30.0 255.255.255.0 set dst 192.168.100.0 255.255.255.0 set gateway 10.200.200.38 set output-device " VPN_SUR_4G_STA" next

[jgalaman]

hello, I also use the dual wan, but without the PBR, just static routes. (VPN iterface mode) http://support.fortinet.com/forum/tm.asp?m=84932&p=2&tmode=1&smode=1 Bye