Issue with Static route Multiple Network lines

[ITServices90]

Hello

We have Multiple sites with Fortigate firewalls.
Each site we have:

• Multiple internet lines in case the main network line stops working and no internet access so it will move to the secondary/third/fourth network line. (configured using SD-WAN)
• IPSec-VPN tunnels to the primary site created with IPSEC Wizard
• 2 Firewalls Configured with HA

The problem is when the main network line goes down,

I don't have access from the primary site to the remote site through the IPsec VPN tunnel. 

I have to manually update the static route of the secondary line to make it work.
I changed the secondary line from Administrative Distance:10 | Priority:1 and changed the primary that doesn't work from Administrative Distance:20 | Priority:2, And when the main line works again, i revert the settings. I don't want to work this way and I want everything to be done automatically.

How do I set up the firewall that if the main line falls,
the secondary line starts working without any change from my side and it will work automatically?
What is the best practice for these settings?

Do I need to use dynamic routing protocols because I have multiple lines?

Static routes config(main site + remote site):

VPN-IPSEC:Main network line: Administrative Distance:10 | Priority:1
VPN IPSEC-Second network line: Administrative Distance:20 | Priority:2
VPN-IPSEC Third network line: Administrative Distance:30 | Priority:3

Interface main network line: Administrative Distance 10 | priority 1

Interface second network line: Administrative Distance 20 | priority 2
and so on

IPSEC VPN-Tunnel config:

Phase 1
set interface "wan2"
set peertype any
set net-device disable
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set comments "VPN: xxxx (Created by VPN wizard)"
set wizard-type static-fortigate
set remote-gw x.x.x.x
set psksecret ENC /XXXXX

Phase 2
edit "xxxxx"
set phase1name "xxxx"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set comments "xxxx (Created by VPN wizard)"
set src-addr-type name
set dst-addr-type name
set src-name "xxxx"
set dst-name "xxxxx"

Thanks!

[tthrilok]

Hi team,

Thank you for the query!

I understand when your primary link goes down, your routes are not automatically falling back to second VPN from primary VPN. Currently you are manually changing the AD and priority of the routes.

In this case, if you are not having the VPN tunnels part of SDWAN, you may configure a link monitor on the remote site firewall:

>> https://community.fortinet.com/t5/FortiGate/Technical-Tip-Link-monitor/ta-p/197504

if you are already having the SDWAN interfaces part of SDWAN, you may use the SDWAN performance SLA which acts like a link monitor for SDWAN.

>> https://docs.fortinet.com/document/fortigate/6.2.12/cookbook/478384/performance-sla-link-monitoring

Above performance SLA article speaks about WAN links, but you may use the same accordingly for your VPNs.

[ITServices90]

Hi tthrilok,

Thanks for your reply :) 

SD-WAN-Zone configured as virtual-wan-link with interface members: main and backup network internet line 

Performacne SLA configured too with this settings:

config health-check
edit "8.8.8.8"
set server "www.google.com"
set interval 1500
set members 0
next
end

system link monitor not configured, do i need to configure it to fix the issue?

or i need to change the current settings?

Thanks a lot!

[Julien87]

Hi ,

no just config health-check in sdwan performance is needed to check Internet status.

For check VPN, you can add a second Zone with vpn interface and check a ressource in the primary site.

Best regards