OSPF over SDWAN dual IPsec connect to DC FGT with non SDWAN ipsec aggreation interface

[ck8882]

HI, May i know does it support OSPF over SDWAN IPSEC - Spoke (with two tunnel IP) to Non SDWAN - Hub (with one single IP and aggregate-member enable) . I notice the once of the ospf interface is process stuck in INIT state. it's like no way for  Remote FGT (Non SDWAN) connect Local FGT (Spoke) tunnel 2 IP.

Diagram like below

Local FGT (Spoke)<------> Remote FGT (Non SDWAN)
Tunnel1 -------Aggregate1 port1
Tunnel2 -------Aggregate1 port2

Local FGT tunnel 1 and 2 using different IP

Aggregate1 port1 and port 2 share single same IP

Due to SDWAN migration phase timing separately deploy for 2 site, so need  any workaround or idea can be solve scenario above

Please help if there is good idea. Thanks

[gfleming]

In FortiGate, SD-WAN is a local construct. You can create an SD-WAN rule so that Tunnel1 and Tunnel2 are participating in SD-WAN even though Remote FGT is not configured for SD-WAN.

Even so there is no reason why you can't intermix technologies here. Of course you can have some non-SD-WAN links particpating on your firewall outside of your SD-WAN links.

I would troubleshoot this just like any other connection.....

1. my understanding—could be wrong—is that aggregate ipsec needs the same config on the other end (for example both FortiGates need dual interfaces with separate tunnels) https://docs.fortinet.com/document/fortigate/6.4.4/administration-guide/779544/ipsec-aggregate-for-r...

2. Do your IPSec interfaces have IP itnerfaces and connectivity between them (So OSPF can talk )?

[ck8882]

HI gfleming,

Thanks for response.

I notice one of OSPF interface keep show "INIT" and another is showing "full"

I also wondering shall it required aggregate ipsec configured in other end ) Local FGT in sdwan feature. 

For your Q2, yes, there is IP configured in the IPSEC interface in "remote FGT", but just allow 1 IP allow to configured. So the 2 aggregate ipsec is same IP.

I wondering would it because remote FGT aggregate ipsec unable point to 2 different remote IP in "local FGT" so that why OSPF flapping cause another ospf interface show "INIT"?

If there is the case, would it have any workaround could achieve it? Appreciate anyone share the idea.

Below is the sample configuration for diagram above. you may take a look.

In Remote FGT (Non SDWAN)
config system interface
edit "S2S" <------(IPSEC Aggregate. only allow use Same IP. which under to wan1 and wan2)
set vdom "root"
set ip 10.10.10.1 255.255.255.255
set allowaccess ping snmp
set type tunnel
set remote-ip 10.10.10.2 255.255.255.240

config vpn ipsec phase1-interface
edit "S2S-VPN1"
set interface "wan1"
set peertype any
set net-device disable
set aggregate-member enable

edit "S2S_VPN2"
set interface "wan2"
set peertype any
set net-device disable
set aggregate-member enable

config router ospf
edit "OSPF_S2S-"
set interface "S2S"
set network-type point-to-point

IN Local FGT (SDWAN)
config system interface
edit "S2S-VPN1" 
set vdom "root"
set ip 10.10.10.3 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.10.10.1 255.255.255.240
set snmp-index 15
set interface "wan1"

edit "S2S-VPN2"
set vdom "root"
set ip 10.10.10.4 255.255.255.255
set allowaccess ping
set type tunnel
set remote-ip 10.10.10.1 255.255.255.240
set snmp-index 14
set interface "wan2"

config ospf-interface
edit "OSPF_S2S-VPN1"
set interface "S2S-VPN1"
set network-type point-to-point

edit "OSPF_S2S-VPN2"
set interface "S2S-VPN2"
set network-type point-to-point

[gfleming]

What is the output of "show system ipsec-aggregate" on the Remote FGT?

And output of " show vpn ipsec phase1-interface" on the Local?

And can you confirm you have IP connectivity between the IPSec tunnels using 10.10.10.1 and 10.10.10.3/.4?

[ck8882]

Hi Gleming

Please see the output below.

Yes. i did configured the ipsec tunnel IP in system interface. you could see the config output or is there any cli command you would like i can capture show it to you?

Or are you saying that we should use 10.10.10.1 and 10.10.10.3/.4 in the "ipsec phase1-interface" instead use the local and remote WAN IP??

In Remote FGT
config system ipsec-aggregate
edit "S2S"
set member "S2S_VPN1" "S2S_VPN2"
set algorithm redundant

config vpn ipsec phase1-interface
edit "S2S-VPN1"
set interface "wan1"
set peertype any
set net-device disable
set aggregate-member enable
set local-gw 172.16.1.1
set remote-gw 172.16.1.2

edit "S2S_VPN2"
set interface "wan2"
set peertype any
set net-device disable
set aggregate-member enable
set local-gw 192.168.100.1
set remote-gw 192.168.100.2

In Local FGT
config vpn ipsec phase1-interface
edit "S2S-VPN2"
set interface "wan2"
set ike-version 2
set local-gw 192.168.100.2
set peertype any
set net-device disable
set remote-gw 192.168.100.1

edit "S2S-VPN1"
set interface "wan1"
set ike-version 2
set local-gw 172.16.1.2
set peertype any
set net-device disable
set nattraversal disable
set remote-gw 172.16.1.1

[gfleming · Accepted solution]

Your IPSEC Aggregate interface is set to redunant mode. This means it will only use first tunnel that is up for all traffic.

Still even so I would suggest moving away from aggregate interface and use two separate tunnels for this. And then use OSPF over each tunnel to maintain reachability.