Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
posemman
New Contributor

IPSec-VPN Backup Line on MPLS connection

Hi all

 

Do you have any idea on how to set-up IPSec-VPN connection(on fortigate) as a back-up line on existing MPLS?

Including also the automatic failover?

 

 

 

8 REPLIES 8
Toshi_Esumi
SuperUser
SuperUser

That's depending on how traffic is routed through MPLS now. If everything is static, you need to have higher cost/distance static routes on the IPSec side for the same destinations. But if it's learning routes via routing protocol, generally need to use the same protocol over the IPSec but adjust some metrics not to prefer the backup side.

If static, you likely need to set link-monitor to detect a disconnection to the destination over MPLS and remove the primary static route.

posemman

Hi Toshi,

 

Thank you for your answer.

Our MPLS use EIGRP routing protocol, is it possible to fortigate to use EIGRP?

 

posemman

Hi, I would like to ask assistance on below issue

 

We set-up policy base ipsec vpn on (HQ)fortigate 300c v5.2.15 and on (RO)Fortigate 60E v5.6.11 for MPLS backup. The tunnel is up and traffic is flowing on both site.  HQ local network: 172.27.14.0/24 Remote Local: 172.27.80.10/32 - This is client device, to only pass thru IPSEC    Then the static route on HQ is: 172.27.0.0 255.255.0.0 to Internal Core Switch(MPLS connection)              > AD of 20 Priority of 0 172.27.80.10 255.255.255.255 IPSEC to REMOTE              > AD of 20 Priority of 1 0.0.0.0 going to (Public internet)              > AD of 10 Priority of 0 -------------------------------------------------------------------------- Then the static route on RO is: 172.16.0.0/12 to router(MPLS connection)             > AD of 10 Priority of 0 172.27.14.0/24 to IPSEC to HQ             > AD of 10 Priority of 1 0.0.0.0 going to (Public internet)             > AD of 5 Priority of 0   Ping and traceroute from RQ(172.27.80.10) to HQ - RESULT GOOD 1 <1 ms <1 ms <1 ms 172.27.80.254 2 * * * Request timed out. 3 10 ms 9 ms 11 ms 172.27.14.25   The issue is the other network device(172.27.1.2) pinging from RQ having intermittent connection(at least 10 packet drops) then it will up again and re occur again. This network is not included in IPSec set-up, so I don't know why it is affected when IPSEC tunnel is up.   Do traceroute from RO going to 172.27.1.2 when intermittent occur: 1 <1 ms <1 ms <1 ms 172.27.80.254 - (FG gateway) 2 <1 ms <1 ms <1 ms 172.27.253.245 - (Router IP of RO) 3 7 ms 7 ms 8 ms 172.27.253.129 - (HQ MPLS Tunnel ip) 4 * * * Request timed out. 5 * * * Request timed out. 6 * * * Request timed out.

posemman
New Contributor

Since we are using EIGRP on MPLS, and fortigate is not compatible on it.

Is it advisable to create additional static route as a countermeasure for IPSec VPN backup line set-up?

 

1. Keep Existing main routing(EIGRP)

2. Create new route(static route) to each sites with higher administrative distance.

 

May I know your input on this if its good design?

Yurisk

As EIGRP is not supported by Fortigate, it means you have your MPLS terminating on equipment that does support EIGRP (Cisco), so EIGRP and its routing is of no interest/concern to the Fortigate.

 

I see 2 possible scenarios here:

- You have say 2 connections on Fortigate - one to Cisco that itself connects to MPLS and runs EIGRP (or may run anything, as said - no business of FGT), and another to the ISP/Internet over which you bring up IPSec VPN. What is left is:

[ul]
  • Have in Fortigate 2 static routes to the remote network, one via Cisco/MPLS and another via IPSec VPN tunnel interface auto-created when you configured the VPN. You want to set different priority for routes accordingly to the way you want to reach the remote network.
  • Decide how you want Fortigate to detect failure of one of those 2 connections. Link-monitor would do the trick by using, e.g. ping to detect when a link fails.[/ul]

    - Second scenario is to let go of the static routing in Fortigate, set up dynamic routing between Cisco of MPLS and Fortigate, say OSPF, redistribute EIGRP routes to OSPF process on Cisco which will advertise them to Fortigate, run dynamic routing protocol in Fortigate over the IPsec VPN with the remote VPN peer (actually optional, but then you have to configure link-monitor and lose benefit of dynamic routing in detecting the link failure), set dynamic protocols routes policy on Fortigate to prefer MPLS or IPSec path to reach the remote network, congratulate yourself on making it through and knowing that only you can support all this :) (just kidding, it is not that complex)

     

    HTH

     

  • Yuri https://yurisk.info/  blog: All things Fortinet, no ads.
    Yuri https://yurisk.info/ blog: All things Fortinet, no ads.
    Toshi_Esumi

    By the way, it's obvious but don't forget you do whatever you choose in Yuri described on both ends. Both sides need to move to the backup path at the same time and fail-back too.

    posemman

    Thank you Yurisk for the suggestion.

    We are now planning to use the 2nd scenario which is to use dynamic routing on each site for IPSec line.

     

    I have question cause I'm not familiar in redistribution of routes thru Fortigate.

    can you give me example on how to set-up the redistribute EIGRP routes to OSPF process on cisco which will advertise them to fortigate.

     

    Hoping for your help. Thank you.

    posemman

    Hi all,

     

    Since we are using EIGRP on MPLS router, do I need to create OSPF on that router to be able to connect it on fortigate?

    Announcements

    Select Forum Responses to become Knowledge Articles!

    Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

    Labels
    Top Kudoed Authors