IPSec tunnel with multiple ISPs

[garjithb]

Hello,

Please take a look at the diagram. The requirement is for Server-1 to connect to Server-2. I need some suggestions for the issue.

The 'Local Gateway" for the tunnel is a public IP defined inside the LAN. So the ISP doesn't matter for the "local gateway".

But when creating a tunnel, Fotigate needs me to select an interface. So the only option for me is to create 2 tunnels on FGT-1 corresponding to each interface/ISP. I have to select the same "remote gateway" with the same "local gateway" over 2 different local interfaces (one corresponding to ISP1 and the other corresponding to ISP-2. The remote end has only one ISP, meaning it won't be able to accept 2 tunnels with the same encryption domains. How do I solve this issue?

[garjithb]

[hbac · Accepted solution]

Hi @garjithb,

Yes, you need to create two tunnels on the local FortiGate. Is the remote firewall also a FortiGate?

Regards, 

[garjithb]

Hello @hbac the remote end is not FortiGate.

So, depending on which ISP is the primary, for both inbound and outbound, that will be the ONLY active tunnel. The other tunnel will be showing as down, right?

[hbac]

@garjithb,

Yes, only tunnels with active ISP will be up. 

Regards, 

[Toshi_Esumi]

Your objective is not clear. Do you need/want to create totally 4 paths (only 2 paths at a time on the active(VRRP) FGT)?
At least with FGTs as long as the interface (tunnel peer) IP addresses are different between two circuits on one side, the other side can be just one circuit with one IP. Then the other side would be terminating four IPsec with four different peer IPs anyway. Any device that can handle multiple VPNs should be able to. That side wouldn't know if the other ends are terminated by one device or multiple devices, since peer IP addresses are different.

Still a remaining question is how you're planning to set up either load-balancing or fail-over between two paths.

Toshi

[garjithb]

Hello,

We run BGP with both the ISPs. So I can influence the inbound and outbound on FGT-1 and FGT-2. So, as long as FGT is VRRP master, everything (traffic as well as the active tunnel) can be controlled. But when the FGT-2 becomes the VRRP master, incoming traffic still comes through ISP-1 (instead of ISP-3 or ISP-4). I guess that is a manual process to modify the BGP parameters.

"as long as the interface (tunnel peer) IP addresses are different between two circuits on one side, the other side can be just one circuit with one IP. "

--> Why does it need to be different? The local and remote gateway remains the same. But I can decide which ISP is primary (for both incoming and outbound traffic)

[Toshi_Esumi]

Are you saying you have your own public subnet and advertising to all ISPs via BGP? That was not described in the OP so I completely misundstood your network.
If that's the case, why do you need tunnels?

Toshi

[Toshi_Esumi]

Or, your own public IP is used for NATing, and LAN subnets are passed over the tunnel, I guess.

[Toshi_Esumi]

If that's the case, you need only one IPsec. Then when the primary internet circuit changes the tunnel would "swing" to the new primary circuit.

Toshi