IPSec site to site VPN, dual peering

[J_Andersen]

Hi

I'd like to hear suggestions and thoughts about how to proceede with the following:

A customer has a site with multi-homed internet acces (two different ISP and public IP's). The customer want a site to site IPSec VPN tunnel to our datacenter (we have a FortiGate), leveraging both public peering IP they have for failover scenario.

Primary will only one peer be used for active traffic, but if this should fail, the sec. should take over.

Should I create two different site-to-site VPN connection to the customer. The phase 2 SA's will contain the same local and remote networks.

And in our Fortigate create 2 different routes, one using the primary VPN logical interface and lower metric and static route for sec. VPN logical interface and a hight metric?

or

Is it possible to create one VPN tunnel, with two peer IPs to use?

Looking forward to hear from you

Kind regards

Jonas

[sw2090]

It is possible with two IPSecs. 

Just create one to each opposite wan with the same netwroks to be accessible over it.

then create static routes with the tunnel interface and different prio/distance .

it will then primaryly use the route with the lower metric and failover to the other if that tunnel is down.

That's the way I currently do that here with the S2Ss from our Sites to HQ.

This is only one way. I read about some others here but I cannot say much about them. Maybe Ken Felx or Toshi or Mike Pruett can?