Partially-redundant IPsec tunnels via different ISPs?

[Vladimir_Ostrovsky]

Good day,

I'm trying to understand, if it's possible to make FortiGate, connected by 2 ports to 2 different ISPs, to have parallel 2 VPN tunnels to the same remote gateway - each tunnel via another ISP. The "Partially-redundant route-based VPN example" page seems to explain similar scenario, but here's a detail I miss there:

FortiGate1 has two Internet-facing ports:

[ul]

WAN1, with IP 192.168.10.2 and next-hop of ISP1 is 192.168.10.1.

WAN2, with IP 172.16.20.2. The next-hop of ISP2 isn't mentioned, but let's suppose it's 172.16.20.1.[/ul]

FortiGate2 has single Internet facing port, with IP 172.16.30.1.

The page instructs to configure 192.168.10.1 as default gateway (to 0.0.0.0/0). So IP of FortiGate2 is obviously reached via this next-hop.

Now let's assume that something in ISP1 broke down and the Tunnel1 is down. DPD will detect that, but I see nothing in this configuration that will tell FortiGate1 that now it needs to deliver IPsec packets to the next-hop of WAN2, 172.16.20.1.

There's nothing that can update the routing table of FortiGate1 to tell it that from now on the route to 172.16.30.1 lies via 172.16.20.1.

So how it's going to work?

Thanks,

Vladimir.

[Vladimir_Ostrovsky]

I haven't found solution for this meanwhile, but if it's possible to add another address to the remote FortiGate2 (for this example let's say it's 172.16.30.2), then the solution is trivial:

[ul]

configure separate static routes for each remote address, via different ISPs:[/ul]

    config router static         edit 1             set dst 172.16.30.1 255.255.255.255             set gateway 192.168.10.1             set device wan1         next         edit 2             set dst 172.16.30.2 255.255.255.255             set gateway 172.16.20.1             set device wan2         next     end

[ul]

configure separate IPsec tunnels to each address, via ports facing different ISPs:[/ul]

    config vpn ipsec phase1-interface         edit Tunnel1             set interface wan1             set peertype any             set proposal aes256-sha256             set dpd on-idle             set remote-gw 172.16.30.1             set psksecret ENC encryptedPreSharedKey1         next         edit Tunnel2             set interface wan2             set peertype any             set proposal aes256-sha256             set dpd on-idle             set remote-gw 172.16.30.2             set psksecret ENC encryptedPreSharedKey2             next     end

    config vpn ipsec phase2-interface         edit Tunnel1             set phase1name Tunnel1             set proposal aes256-sha256         next         edit Tunnel2             set phase1name Tunnel2             set proposal aes256-sha256         next     end

[ul]

wrap them in a common 'zone' object to be used in firewall policies:[/ul]

    config system zone         edit FortiGate2_zone             set interface Tunnel1 Tunnel2         next     end

[ul]

Then set up either duplicate static routes, assigning different distances / priorities, over both tunnels to the networks behind FortiGate2 - or set up dynamic routing (e.g. OSPF) with different costs for the two tunnel interfaces. Or assign the same and use ECMP.[/ul]

Now if the (preferrable) tunnel fails, then DPD (or OSPF) will detect that, the logical interface will be marked as 'down', its routes will be removed from the routing table and all traffic will flow via the second tunnel.

[Vladimir_Ostrovsky]

Now let's say that FortiGate1 isn't connected directly to both ISPs - these links are moved to some NAT router, behind which sits FortiGate1. The router has public IPs from both ISP and performs NAT on behalf of the FortiGate.

Then the setup will be different:

[ul]

No need to configure special static routes on FortiGate1 - all traffic will flow to the NAT router via WAN1.

We need to configure secondary IP address on WAN1:[/ul]

    config system interface         edit wan1             set vdom root             set ip 192.168.10.2 255.255.255.0             set type physical             set secondary-IP enable             config secondaryip             edit 1                 set ip 192.168.10.3 255.255.255.0             next             end         next     end

[ul]

Now we can establish two IPsec tunnels - each to different address of FortiGate2. We'll use local-gw parameter to specify, which local IP should be used for each:[/ul]

    config vpn ipsec phase1-interface         edit Tunnel1             set interface wan1             set local-gw 192.168.10.2             set peertype any             set proposal aes256-sha256             set dpd on-idle             set remote-gw 172.16.30.1             set psksecret ENC encryptedPreSharedKey1         next         edit Tunnel2             set interface wan1             set local-gw 192.168.10.3             set peertype any             set proposal aes256-sha256             set dpd on-idle             set remote-gw 172.16.30.2             set psksecret ENC encryptedPreSharedKey2         next     end

[ul]

The rest of the setup is like in the example above. Of course, the NAT router should be configured:[ul]

to SNAT addresses 192.168.10.2 & 192.168.10.3 to public addresses from different ISPs.

to route traffic to 172.16.30.1 & 172.16.30.2 via different ISPs.[/ul][/ul]

That's all.