Multiple GRE tunnels of Fortigate 101E (OS6.4)

[msusmani]

Hi 

I have recently installed a Fortigate 101E firewall. I am trying to create multiple GRE tunnels between my Fortigate and mikrotik RB750 router. I have successfully created one tunnel interface but when try to create more tunnel interfaces fortigate CLI gives error. Public IP's on Forigate and Mikrotik will be same for every tunnel interface but just want to create multiple tunnel interfaces with different subnets for my ultiple customers. Kindly suggest if it is possible.

Regards 

Muhammad

[emnoc]

Public IP's on Forigate and Mikrotik will be same for every tunnel interface but just want to create multiple tunnel interfaces with different subnets for my ultiple customers. Kindly suggest if it is possible.

You can't do that. Why do you need multiple tunnels for a GRE connection between the same two device ?

You might can get away with nailing the tunnel to a loopback interface

e.g ( assuming you had loopback with 192.0.2.119 .120 .121  and you snat these behind the wan interface)

config system gre-tunnel edit "cust1" set interface "loop1" set remote-gw 12.12.12.12 set local-gw 192.0.2.119 set key-outbound 456728 set key-inbound 456728 next

edit "cust2" set interface "loop2" set remote-gw 12.12.12.12 set local-gw 192.0.2.120 set key-outbound 456729 set key-inbound 4567229 next

edit "cust3" set interface "loop3" set remote-gw 12.12.12.12 set local-gw 192.0.2.121 set key-outbound 456730 set key-inbound 4567230 next end

The src 192.0.2.119/120/121 will need to egress nat'd to your wan1 public address.

The above all depends on if the far end support GRE-keys if that's not obvious. I still think your reason or design is flawed if you need multiple tunnels to the same destination. You have many other options like using routing and filters based on src/dst pairs.

Also gre key is support if 6.4.x for sure 6.2x and I believe 6.x

Ken Felix

[Siang4331]

Hi, i like to ask since its only possible to get 1 tunnel for 1 FG device, how does the tunnel failover work?

[srajeswaran]

Tunnel failover comes into picture when you have 2 different tunnels between source and destination sites using 2 separate links (which means the source IP and/or destination IP will be different). We cannot have 2 tunnels between same sourceIP/destination IP, it is not redundancy or failover mechanism. You need 2 separate links to have failover/redundancy and it is possible with Fortigate.

[Siang4331]

ok, thanks for the info