IPSec with ECMP Load Balance

[maxwee]

Hi Guys,

Need the expert help here.

I've got 2 of Fortigate200D setup as Active-Passive. Both has got 2 WAN link to internet, configured with ECMP weighted load balance. I've got IPSec setup by our MPLS provider as backup link. This IPSec tunnel sits on a static IP on WAN1. Heres the thing, when both WAN are plugged in, I'm getting intermitten ping loss to IPSec router, but when only WAN1 is connected, all is good. I have tried to configure policy routes but to no avail. I'm 100% sure this has got to do with the 200D wan load balancing algorithm. Any experts care to share some advise or has anyone had previous experience?

Thanks!

[kallbrandt · Accepted solution]

I understand. And I guess you have the same values for distance/prio on both routes, so that is not an issue. That part looks fine from what you posted here.

Ok, on to the PBR then. Let's see if I understood you correctly. Feel free to tell me otherwise. :)

From what you posted here, you'll need to specify the IPsec-interface as outgoing (it is mapped to WAN1 anyway), and also specify the destination network (since you only want to perform PBR on the traffic destined for the other side of the tunnel, not everything).

If you use destination network 0.0.0.0/0 here, you will have to make rules for the networks that you don't want to do PBR on (the "stop policy routing"-option in the rule), otherwise you will force everything that way. Don't specify gateway if you don't have to. Keeping gw to 0.0.0.0 means the PBR will use the gateway specified for the network in the routing table.

For example: I have a PBR rule from a source interface/network that use 0.0.0.0/0 as destination. Since I only want to perform PBR on traffic destined for internet, I created 3 rules that stops PBR to 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 before the PBR rule.

[kallbrandt]

Hello,

please share the parts of your config that contains the wan LLB setup, the routing table, and the PBR-rules.

PM or obfuscate the IPs if you don't want to share them.

WAN-LLB has certain limitations in my point of view - Do you actually need both wan active at the same time, or do you just want a redundant way out to internet?

[maxwee]

Yea i need both wan to be active at the same time. due to the low internet bandwidth vs number of users.

WAN LLB setup

Static Routes

PBR

Incoming - lan

Outgoing - wan1

Source - IPSec Tunnel IP

Destination: 0.0.0.0/0.0.0.0

Gateway: wan1 gateway

[kallbrandt · Accepted solution]

I understand. And I guess you have the same values for distance/prio on both routes, so that is not an issue. That part looks fine from what you posted here.

Ok, on to the PBR then. Let's see if I understood you correctly. Feel free to tell me otherwise. :)

From what you posted here, you'll need to specify the IPsec-interface as outgoing (it is mapped to WAN1 anyway), and also specify the destination network (since you only want to perform PBR on the traffic destined for the other side of the tunnel, not everything).

If you use destination network 0.0.0.0/0 here, you will have to make rules for the networks that you don't want to do PBR on (the "stop policy routing"-option in the rule), otherwise you will force everything that way. Don't specify gateway if you don't have to. Keeping gw to 0.0.0.0 means the PBR will use the gateway specified for the network in the routing table.

For example: I have a PBR rule from a source interface/network that use 0.0.0.0/0 as destination. Since I only want to perform PBR on traffic destined for internet, I created 3 rules that stops PBR to 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 before the PBR rule.

[Toshi_Esumi · Accepted solution]

First I'm not an expert so please forgive me, but I'm wondering if just putting a static route for the IPSec destination (/32) toward WAN1 interface would work to nail the IPSec tunnel traffic for both directions while the rest follows the load balancing rules.

[maxwee]

Hi Richie,

You're the man! Setting PBR with your pointed direction solved my problem! Before this, I made a mistake by specifying tunnel source IP in PBR whereby I should have set source IP as the tunnel WAN IP.

Thanks man!

Hi Toshi-san,

Thanks for your input. I managed to solved my problem with Richie's help, setting PBR. Technically, your method via setting static route should work too. But, I would need to know the tunnel destination WAN IP (this I do not know as the tunnel is managed by MPLS provider), and also, if there are any changes to tunnel destination, I will need to change static route too. By setting PBR, as long as my WAN IP does not change, no further changes are required down the road.

[kallbrandt]

Thank you! Glad that it worked out.