Hello
We have Multiple sites with Fortigate firewalls.
Each site we have:
The problem is when the main network line goes down,
I don't have access from the primary site to the remote site through the IPsec VPN tunnel.
I have to manually update the static route of the secondary line to make it work.
I changed the secondary line from Administrative Distance:10 | Priority:1 and changed the primary that doesn't work from Administrative Distance:20 | Priority:2, And when the main line works again, i revert the settings. I don't want to work this way and I want everything to be done automatically.
How do I set up the firewall that if the main line falls,
the secondary line starts working without any change from my side and it will work automatically?
What is the best practice for these settings?
Do I need to use dynamic routing protocols because I have multiple lines?
Static routes config(main site + remote site):
VPN-IPSEC:Main network line: Administrative Distance:10 | Priority:1
VPN IPSEC-Second network line: Administrative Distance:20 | Priority:2
VPN-IPSEC Third network line: Administrative Distance:30 | Priority:3
Interface main network line: Administrative Distance 10 | priority 1
Interface second network line: Administrative Distance 20 | priority 2
and so on
IPSEC VPN-Tunnel config:
Phase 1
set interface "wan2"
set peertype any
set net-device disable
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set comments "VPN: xxxx (Created by VPN wizard)"
set wizard-type static-fortigate
set remote-gw x.x.x.x
set psksecret ENC /XXXXX
Phase 2
edit "xxxxx"
set phase1name "xxxx"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set comments "xxxx (Created by VPN wizard)"
set src-addr-type name
set dst-addr-type name
set src-name "xxxx"
set dst-name "xxxxx"
Thanks!
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi team,
Thank you for the query!
I understand when your primary link goes down, your routes are not automatically falling back to second VPN from primary VPN. Currently you are manually changing the AD and priority of the routes.
In this case, if you are not having the VPN tunnels part of SDWAN, you may configure a link monitor on the remote site firewall:
>> https://community.fortinet.com/t5/FortiGate/Technical-Tip-Link-monitor/ta-p/197504
if you are already having the SDWAN interfaces part of SDWAN, you may use the SDWAN performance SLA which acts like a link monitor for SDWAN.
>> https://docs.fortinet.com/document/fortigate/6.2.12/cookbook/478384/performance-sla-link-monitoring
Above performance SLA article speaks about WAN links, but you may use the same accordingly for your VPNs.
Created on 04-17-2023 06:34 AM Edited on 04-17-2023 06:37 AM
Hi tthrilok,
Thanks for your reply :)
SD-WAN-Zone configured as virtual-wan-link with interface members: main and backup network internet line
Performacne SLA configured too with this settings:
config health-check
edit "8.8.8.8"
set server "www.google.com"
set interval 1500
set members 0
next
end
system link monitor not configured, do i need to configure it to fix the issue?
or i need to change the current settings?
Thanks a lot!
Hi ,
no just config health-check in sdwan performance is needed to check Internet status.
For check VPN, you can add a second Zone with vpn interface and check a ressource in the primary site.
Best regards
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1547 | |
1031 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.