Please help if there is good idea. Thanks
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Your IPSEC Aggregate interface is set to redunant mode. This means it will only use first tunnel that is up for all traffic.
Still even so I would suggest moving away from aggregate interface and use two separate tunnels for this. And then use OSPF over each tunnel to maintain reachability.
In FortiGate, SD-WAN is a local construct. You can create an SD-WAN rule so that Tunnel1 and Tunnel2 are participating in SD-WAN even though Remote FGT is not configured for SD-WAN.
Even so there is no reason why you can't intermix technologies here. Of course you can have some non-SD-WAN links particpating on your firewall outside of your SD-WAN links.
I would troubleshoot this just like any other connection.....
1. my understanding—could be wrong—is that aggregate ipsec needs the same config on the other end (for example both FortiGates need dual interfaces with separate tunnels) https://docs.fortinet.com/document/fortigate/6.4.4/administration-guide/779544/ipsec-aggregate-for-r...
2. Do your IPSec interfaces have IP itnerfaces and connectivity between them (So OSPF can talk )?
HI gfleming,
Thanks for response.
I notice one of OSPF interface keep show "INIT" and another is showing "full"
I also wondering shall it required aggregate ipsec configured in other end ) Local FGT in sdwan feature.
For your Q2, yes, there is IP configured in the IPSEC interface in "remote FGT", but just allow 1 IP allow to configured. So the 2 aggregate ipsec is same IP.
I wondering would it because remote FGT aggregate ipsec unable point to 2 different remote IP in "local FGT" so that why OSPF flapping cause another ospf interface show "INIT"?
If there is the case, would it have any workaround could achieve it? Appreciate anyone share the idea.
Below is the sample configuration for diagram above. you may take a look.
In Remote FGT (Non SDWAN)
config system interface
edit "S2S" <------(IPSEC Aggregate. only allow use Same IP. which under to wan1 and wan2)
set vdom "root"
set ip 10.10.10.1 255.255.255.255
set allowaccess ping snmp
set type tunnel
set remote-ip 10.10.10.2 255.255.255.240
config vpn ipsec phase1-interface
edit "S2S-VPN1"
set interface "wan1"
set peertype any
set net-device disable
set aggregate-member enable
edit "S2S_VPN2"
set interface "wan2"
set peertype any
set net-device disable
set aggregate-member enable
config router ospf
edit "OSPF_S2S-"
set interface "S2S"
set network-type point-to-point
IN Local FGT (SDWAN)
config system interface
edit "S2S-VPN1"
set vdom "root"
set ip 10.10.10.3 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.10.10.1 255.255.255.240
set snmp-index 15
set interface "wan1"
edit "S2S-VPN2"
set vdom "root"
set ip 10.10.10.4 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.10.10.1 255.255.255.240
set snmp-index 14
set interface "wan2"
config ospf-interface
edit "OSPF_S2S-VPN1"
set interface "S2S-VPN1"
set network-type point-to-point
edit "OSPF_S2S-VPN2"
set interface "S2S-VPN2"
set network-type point-to-point
What is the output of "show system ipsec-aggregate" on the Remote FGT?
And output of " show vpn ipsec phase1-interface" on the Local?
And can you confirm you have IP connectivity between the IPSec tunnels using 10.10.10.1 and 10.10.10.3/.4?
Hi Gleming
Please see the output below.
Yes. i did configured the ipsec tunnel IP in system interface. you could see the config output or is there any cli command you would like i can capture show it to you?
Or are you saying that we should use 10.10.10.1 and 10.10.10.3/.4 in the "ipsec phase1-interface" instead use the local and remote WAN IP??
In Remote FGT
config system ipsec-aggregate
edit "S2S"
set member "S2S_VPN1" "S2S_VPN2"
set algorithm redundant
config vpn ipsec phase1-interface
edit "S2S-VPN1"
set interface "wan1"
set peertype any
set net-device disable
set aggregate-member enable
set local-gw 172.16.1.1
set remote-gw 172.16.1.2
edit "S2S_VPN2"
set interface "wan2"
set peertype any
set net-device disable
set aggregate-member enable
set local-gw 192.168.100.1
set remote-gw 192.168.100.2
In Local FGT
config vpn ipsec phase1-interface
edit "S2S-VPN2"
set interface "wan2"
set ike-version 2
set local-gw 192.168.100.2
set peertype any
set net-device disable
set remote-gw 192.168.100.1
edit "S2S-VPN1"
set interface "wan1"
set ike-version 2
set local-gw 172.16.1.2
set peertype any
set net-device disable
set nattraversal disable
set remote-gw 172.16.1.1
Your IPSEC Aggregate interface is set to redunant mode. This means it will only use first tunnel that is up for all traffic.
Still even so I would suggest moving away from aggregate interface and use two separate tunnels for this. And then use OSPF over each tunnel to maintain reachability.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1502 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.