Loadbalance messing UP IPSEC_VPN

[hervaltelecom]

Hello!

I need help diagnosing loadbalance cousing strange behavior with IPSEC_VPN. I have two IPSEC_VPN configured on ports WAN2 and DMZ with the following configuration:

edit "VPN_HERVAL"
set interface "wan2"
set keylife 28800
set mode aggressive
set proposal 3des-sha1
set localid "stores"
set dhgrp 5
set remote-gw XXX.XXX.XXX.XXX
set psksecret ENC

next
edit "VPN_HERVAL_B"
set interface "dmz"
set keylife 28800
set mode aggressive
set proposal 3des-sha1
set localid "stores"
set dhgrp 5
set remote-gw XXX.XXX.XXX.XXX
set psksecret ENC

next
end
config vpn ipsec phase2-interface
edit "VPN_HERVAL"
set phase1name "VPN_HERVAL"
set proposal 3des-sha1
set dhgrp 5
set keepalive enable
set auto-negotiate enable
set keylifeseconds 1800
set src-subnet 10.12.72.0 255.255.255.0
next
edit "VPN_HERVAL_B"
set phase1name "VPN_HERVAL_B"
set proposal 3des-sha1
set dhgrp 5
set keepalive enable
set auto-negotiate enable
set keylifeseconds 1800
set src-subnet 10.12.72.0 255.255.255.0
next
end

My loadbalance is as follow:

config system virtual-wan-link
    set status enable
    set load-balance-mode weight-based
    set load-balance-quality-mode latency-based
        config members
            edit 1
                set interface "dmz"
                set gateway 192.168.0.1
                set weight 6
                set spillover-threshold 110
                set detect-server "XXX.XXX.XXX.XXX"
            next
            edit 2
                set interface "wan2"
                set gateway 192.168.25.1
                set weight 4
                set spillover-threshold 40
                set detect-server "XXX.XXX.XXX.XXX"
            next
        end
end

And my routes are as follow:

config router static
    edit 3
        set dst 172.16.0.0 255.240.0.0
        set gateway 10.252.72.1

        set distance 10
        set device "wan1"
        set comment "Route for Embratel MPLS, has priority over VPN A."
    next
    edit 4
        set dst 172.16.0.0 255.240.0.0
        set priority 10

        set distance 10
        set device "VPN_HERVAL"
        set comment "Route for VPN_A, has priority over VPN_B."
    next
    edit 1
        set dst 172.16.0.0 255.240.0.0
        set distance 15
        set device "VPN_HERVAL_B"
        set comment "Route for secundary VPN."
    next
    edit 5
        set virtual-wan-link enable

        set distance 10
    next
end

Both VPN connect to the same external IP (pointed to another Fortigate). When the primary route goes off-line (static route 3) loadbalance starts to connect and disconnect on both VPN making communicantions impossible do to repeated disconnects and reconnects. Shouldn't load-balance only balance http requests, leaving IP_SEC alone to follow static routes?

Can some one help me? Thanks in advance.

Att.,

[hervaltelecom]

No help?