OSPF over SDWAN dual IPsec connect to DC FGT with non SDWAN ipsec aggreation interface
HI, May i know does it support OSPF over SDWAN IPSEC - Spoke (with two tunnel IP) to Non SDWAN - Hub (with one single IP and aggregate-member enable) . I notice the once of the ospf interface is process stuck in INIT state. it's like no way for Remote FGT (Non SDWAN) connect Local FGT (Spoke) tunnel 2 IP.
I notice one of OSPF interface keep show "INIT" and another is showing "full"
I also wondering shall it required aggregate ipsec configured in other end ) Local FGT in sdwan feature.
For your Q2, yes, there is IP configured in the IPSEC interface in "remote FGT", but just allow 1 IP allow to configured. So the 2 aggregate ipsec is same IP.
I wondering would it because remote FGT aggregate ipsec unable point to 2 different remote IP in "local FGT" so that why OSPF flapping cause another ospf interface show "INIT"?
If there is the case, would it have any workaround could achieve it? Appreciate anyone share the idea.
Below is the sample configuration for diagram above. you may take a look.
In Remote FGT (Non SDWAN) config system interface edit "S2S" <------(IPSEC Aggregate. only allow use Same IP. which under to wan1 and wan2) set vdom "root" set ip 10.10.10.1 255.255.255.255 set allowaccess ping snmp set type tunnel set remote-ip 10.10.10.2 255.255.255.240
config vpn ipsec phase1-interface edit "S2S-VPN1" set interface "wan1" set peertype any set net-device disable set aggregate-member enable
edit "S2S_VPN2" set interface "wan2" set peertype any set net-device disable set aggregate-member enable
config router ospf edit "OSPF_S2S-" set interface "S2S" set network-type point-to-point
IN Local FGT (SDWAN) config system interface edit "S2S-VPN1" set vdom "root" set ip 10.10.10.3 255.255.255.255 set allowaccess ping set type tunnel set remote-ip 10.10.10.1 255.255.255.240 set snmp-index 15 set interface "wan1"
edit "S2S-VPN2" set vdom "root" set ip 10.10.10.4 255.255.255.255 set allowaccess ping set type tunnel set remote-ip 10.10.10.1 255.255.255.240 set snmp-index 14 set interface "wan2"
config ospf-interface edit "OSPF_S2S-VPN1" set interface "S2S-VPN1" set network-type point-to-point
edit "OSPF_S2S-VPN2" set interface "S2S-VPN2" set network-type point-to-point
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.