IPSec-VPN Backup Line on MPLS connection

[posemman]

Hi all

Do you have any idea on how to set-up IPSec-VPN connection(on fortigate) as a back-up line on existing MPLS?

Including also the automatic failover?

[Toshi_Esumi]

That's depending on how traffic is routed through MPLS now. If everything is static, you need to have higher cost/distance static routes on the IPSec side for the same destinations. But if it's learning routes via routing protocol, generally need to use the same protocol over the IPSec but adjust some metrics not to prefer the backup side.

If static, you likely need to set link-monitor to detect a disconnection to the destination over MPLS and remove the primary static route.

[posemman]

Hi Toshi,

Thank you for your answer.

Our MPLS use EIGRP routing protocol, is it possible to fortigate to use EIGRP?

[posemman]

Hi, I would like to ask assistance on below issue

We set-up policy base ipsec vpn on (HQ)fortigate 300c v5.2.15 and on (RO)Fortigate 60E v5.6.11 for MPLS backup. The tunnel is up and traffic is flowing on both site.  HQ local network: 172.27.14.0/24 Remote Local: 172.27.80.10/32 - This is client device, to only pass thru IPSEC    Then the static route on HQ is: 172.27.0.0 255.255.0.0 to Internal Core Switch(MPLS connection)              > AD of 20 Priority of 0 172.27.80.10 255.255.255.255 IPSEC to REMOTE              > AD of 20 Priority of 1 0.0.0.0 going to (Public internet)              > AD of 10 Priority of 0 -------------------------------------------------------------------------- Then the static route on RO is: 172.16.0.0/12 to router(MPLS connection)             > AD of 10 Priority of 0 172.27.14.0/24 to IPSEC to HQ             > AD of 10 Priority of 1 0.0.0.0 going to (Public internet)             > AD of 5 Priority of 0   Ping and traceroute from RQ(172.27.80.10) to HQ - RESULT GOOD 1 <1 ms <1 ms <1 ms 172.27.80.254 2 * * * Request timed out. 3 10 ms 9 ms 11 ms 172.27.14.25   The issue is the other network device(172.27.1.2) pinging from RQ having intermittent connection(at least 10 packet drops) then it will up again and re occur again. This network is not included in IPSec set-up, so I don't know why it is affected when IPSEC tunnel is up.   Do traceroute from RO going to 172.27.1.2 when intermittent occur: 1 <1 ms <1 ms <1 ms 172.27.80.254 - (FG gateway) 2 <1 ms <1 ms <1 ms 172.27.253.245 - (Router IP of RO) 3 7 ms 7 ms 8 ms 172.27.253.129 - (HQ MPLS Tunnel ip) 4 * * * Request timed out. 5 * * * Request timed out. 6 * * * Request timed out.

[posemman]

Since we are using EIGRP on MPLS, and fortigate is not compatible on it.

Is it advisable to create additional static route as a countermeasure for IPSec VPN backup line set-up?

1. Keep Existing main routing(EIGRP)

2. Create new route(static route) to each sites with higher administrative distance.

May I know your input on this if its good design?

[Yurisk]

As EIGRP is not supported by Fortigate, it means you have your MPLS terminating on equipment that does support EIGRP (Cisco), so EIGRP and its routing is of no interest/concern to the Fortigate.

I see 2 possible scenarios here:

- You have say 2 connections on Fortigate - one to Cisco that itself connects to MPLS and runs EIGRP (or may run anything, as said - no business of FGT), and another to the ISP/Internet over which you bring up IPSec VPN. What is left is:

[ul]

Have in Fortigate 2 static routes to the remote network, one via Cisco/MPLS and another via IPSec VPN tunnel interface auto-created when you configured the VPN. You want to set different priority for routes accordingly to the way you want to reach the remote network.

Decide how you want Fortigate to detect failure of one of those 2 connections. Link-monitor would do the trick by using, e.g. ping to detect when a link fails.[/ul]

- Second scenario is to let go of the static routing in Fortigate, set up dynamic routing between Cisco of MPLS and Fortigate, say OSPF, redistribute EIGRP routes to OSPF process on Cisco which will advertise them to Fortigate, run dynamic routing protocol in Fortigate over the IPsec VPN with the remote VPN peer (actually optional, but then you have to configure link-monitor and lose benefit of dynamic routing in detecting the link failure), set dynamic protocols routes policy on Fortigate to prefer MPLS or IPSec path to reach the remote network, congratulate yourself on making it through and knowing that only you can support all this :) (just kidding, it is not that complex)

HTH

[Toshi_Esumi]

By the way, it's obvious but don't forget you do whatever you choose in Yuri described on both ends. Both sides need to move to the backup path at the same time and fail-back too.

[posemman]

Thank you Yurisk for the suggestion.

We are now planning to use the 2nd scenario which is to use dynamic routing on each site for IPSec line.

I have question cause I'm not familiar in redistribution of routes thru Fortigate.

can you give me example on how to set-up the redistribute EIGRP routes to OSPF process on cisco which will advertise them to fortigate.

Hoping for your help. Thank you.

[posemman]

Hi all,

Since we are using EIGRP on MPLS router, do I need to create OSPF on that router to be able to connect it on fortigate?