recently we have implemented p2p connection between 2 sites both sites has fortigate 101F in branch office and 400F i guess in HQ. we have two links L2 VPN p2p and L3 VPN p2p. here is the config example.
2MB 1st link interface IP 172.97.66.6 other end 172.97.66.5
IPsec tunnel IP 172.97.66.45 other end 172.97.66.46
2MB 2nd link Interface IP 172.101.19.182 other end 172.101.19.181
IPsec tunnel IP 172.97.66.53 other end 172.97.66.54
reason of posing this is because of delay in communication our AD and all other servers on other site and utilization is not always full.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
First of all, an "L2 Link" generally means a point-to-point circuit between both ends so you don't need IPSec over it. For L3 circuits, I assume those are just separate internet circuits on both ends then you've set up IPSec VPN to connect them.
The first thing you want to look at is any packet losses or larger-than-expected latency on each link. The SD-WAN statistics should show you the numbers in "diag sys virtual-wan-link health-check" command like in the cookbook (6.2):
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/818746/sd-wan-related-diagnose-commands
Then if identified, you need to troubleshoot with the circuit venders especially for L2 circuit. For L3 circuits, first you need to figure out where/which side is causing the packet losses/larger latency by testing each L3 circuit separately.
Yes but traffic is going through iSP so it should be encrypted correct me if i am wrong,
here is the troubleshoot result.
diagnose sys virtual-wan-link health-check
Health Check(XSDWANSLA): Seq(1): state(alive), packet-loss(10.000%) latency(4.254), jitter(1.145) sla_map=0x1 Health Check(XSDWANICSLA): Seq(2): state(alive), packet-loss(0.000%) latency(0.722), jitter(0.014) sla_map=0x0
diagnose sys virtual-wan-link member
Member(1): interface: SC-IPSec-VPN, gateway: 172.16.66.9, priority: 0, weight: 28 Config volume ratio: 1, last reading: 40043617689B, volume room 28MB Member(2): interface: IC-IPSec-VPN, gateway: 172.16.66.13, priority: 0, weight: 27 Config volume ratio: 1, last reading: 40088009183B, volume room 27MB
is it over loaded?
You definitely need to fix the cause of the 10% packet loss first before looking into anything else.
L2 links between two locations are generally considered as "dedicated wires". I never hear anybody set up an IPSec VPN over it although of course nothing is wrong doing so. And I don't think it has anything to do with the problem. Based on the usage graphs, you're not over-utilizing circuits. Likely you would feel more normal when you fixed the packet loss.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1702 | |
1092 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.