Redundant IPSec tunnel help

[shani786]

hello experts!

 i want to configure a site-to-site VPN between 2 sites. 

Site "A" has 2 ISP links and here I want to create 2 redundant IPSec tunnels with site "B".

so the problem is that site "B" has only 1 wan link and site "A" has 2 wan links. As shown above image. so how can i configure any help would be appreciated thanks.

ipsec

[VinayHM · Accepted solution]

Hi 

Please go through the below link for the Redundant IPSEC Tunnel using a single WAN connection

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Redundant-IPSEC-Tunnel-using-single-WAN-co...

Regards,

[shani786]

hi!
thank you for the help. one more thing i want to discuss here i tried the method and applied it successfully but one problem i face the downtime while the static ipsec route to 2nd backup tunnel it takes up to 2 minutes to up what will be the solution i want to decrease the downtime any help would be appreciated. 

[Toshi_Esumi]

Then try IPSec aggregate instead. With this both sides are up and utilized all the time, and bringing down one side shouldn't cause much down time. Although below cookbook shows two circuits on both locations, it should work as well as long as one side has two circuits. I tested that way when 6.2 came out. I would assume it still work with like 7.0 - 7.4.
https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/779544/ipsec-aggregate-for-redundancy-a...

Toshi

[chitra150]

Hello,

You should check this doc.
https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/779544/ipsec-aggregate-for-splunk training-redundancy-and-traffic-load-balancing

I hope this will help you.