Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
garjithb
New Contributor II

IPSec tunnel with multiple ISPs

Hello,

 

Please take a look at the diagram. The requirement is for Server-1 to connect to Server-2. I need some suggestions for the issue.

 

The 'Local Gateway" for the tunnel is a public IP defined inside the LAN. So the ISP doesn't matter for the "local gateway".

 

But when creating a tunnel, Fotigate needs me to select an interface. So the only option for me is to create 2 tunnels on FGT-1 corresponding to each interface/ISP. I have to select the same "remote gateway" with the same "local gateway" over 2 different local interfaces (one corresponding to ISP1 and the other corresponding to ISP-2. The remote end has only one ISP, meaning it won't be able to accept 2 tunnels with the same encryption domains. How do I solve this issue?

1 Solution
hbac

Hi @garjithb,

 

Yes, you need to create two tunnels on the local FortiGate. Is the remote firewall also a FortiGate?

 

Regards, 

View solution in original post

10 REPLIES 10
garjithb
New Contributor II

Screenshot 2023-10-26 at 1.11.19 PM.png

hbac

Hi @garjithb,

 

Yes, you need to create two tunnels on the local FortiGate. Is the remote firewall also a FortiGate?

 

Regards, 

garjithb
New Contributor II

Hello @hbac the remote end is not FortiGate.

 

So, depending on which ISP is the primary, for both inbound and outbound, that will be the ONLY active tunnel. The other tunnel will be showing as down, right?

hbac

@garjithb,

 

Yes, only tunnels with active ISP will be up. 

 

Regards, 

Toshi_Esumi
Esteemed Contributor III

Your objective is not clear. Do you need/want to create totally 4 paths (only 2 paths at a time on the active(VRRP) FGT)?
At least with FGTs as long as the interface (tunnel peer) IP addresses are different between two circuits on one side, the other side can be just one circuit with one IP. Then the other side would be terminating four IPsec with four different peer IPs anyway. Any device that can handle multiple VPNs should be able to. That side wouldn't know if the other ends are terminated by one device or multiple devices, since peer IP addresses are different.

Still a remaining question is how you're planning to set up either load-balancing or fail-over between two paths.

 

Toshi

garjithb

Hello,

 

We run BGP with both the ISPs. So I can influence the inbound and outbound on FGT-1 and FGT-2. So, as long as FGT is VRRP master, everything (traffic as well as the active tunnel) can be controlled. But when the FGT-2 becomes the VRRP master, incoming traffic still comes through ISP-1 (instead of ISP-3 or ISP-4). I guess that is a manual process to modify the BGP parameters.

 

"as long as the interface (tunnel peer) IP addresses are different between two circuits on one side, the other side can be just one circuit with one IP. "

 

--> Why does it need to be different? The local and remote gateway remains the same. But I can decide which ISP is primary (for both incoming and outbound traffic)

Toshi_Esumi
Esteemed Contributor III

Are you saying you have your own public subnet and advertising to all ISPs via BGP? That was not described in the OP so I completely misundstood your network.
If that's the case, why do you need tunnels?


Toshi

Toshi_Esumi
Esteemed Contributor III

Or, your own public IP is used for NATing, and LAN subnets are passed over the tunnel, I guess.

Toshi_Esumi
Esteemed Contributor III

If that's the case, you need only one IPsec. Then when the primary internet circuit changes the tunnel would "swing" to the new primary circuit.

 

Toshi

Labels
Top Kudoed Authors