Redundant VPN config help

[BryanS]

Hello all, have a VPN project and having a problem.  Almost got it though...

 I have a 200E and a test 60E at a remote site I want to set up a VPN between the 2 sites, but have redundancy for the 200E if an ISP goes down at the 200E location. 200E config: WAN1 - ISP1WAN2 - ISP2 Primary VPN on WAN1 - working   10/0Backup VPN on WAN2 - not working on failover  20/0 link-monitor configured on both WAN1 and WAN2 60E config: WAN1 - ISP1 (only 1 ISP here) Primary VPN on WAN1 - Connects fine to primary on 200E to WAN1  10/0Backup VPN on WAN1 - Would connect to the WAN2 IP of the 200E  20/0 link-monitor running on WAN1 (only to match configs of FGs) If I software disable WAN1 or pull the Eth out of WAN1 -- Internet switches over to WAN2, no downtime. 200E primary VPN was working perfectly. After WAN1 goes offline, drop in vpn traffic seen but Backup VPN does not come online.  I can see phase 1 success messages for backup VPN, but no traffic passes or tunnel showing online. What am I missing?

[mahesh_secure]

Hi

please share the below command output

diag vpn ike log filter name <phase1-name> diag debug app ike -1 diag debug enable

Regards

Mahesh

[BryanS]

mahesh p mohan wrote:

Hi

please share the below command output

diag vpn ike log filter name <phase1-name> diag debug app ike -1 diag debug enable

Regards

Mahesh

Here was the output:

 Connected FG200 # diag vpn ike log filter name H 

FG200 # diag debug app ike -1Debug messages will be on for 20 minutes. 

FG200 # diag debug enable 

FG200 # ike 0: cache rebuild doneike 0: cache rebuild done

ike 0:H_Backup: auto-negotiate connectionike 0:H_Backup: created connection: 0x1409e5e0 18 67.xx.xx.xx->73.xx.xx.xx :500.

ike 0: cache rebuild doneike 0: cache rebuild doneike 0:H_Backup: auto-negotiate connectionike 0:H_Backup: created connection: 0x1409e5e0 18 67.xx.xx.xx->73.xx.xx.xx :500.

ike 0: cache rebuild doneike 0: cache rebuild done

ike 0:H_Backup: auto-negotiate connection

ike 0:H_Backup: created connection: 0x1409e5e0 18 67.xx.xx.xx->73.xx.xx.xx :500.ike 0: cache rebuild doneike 0: cache rebuild doneike 0:H_Backup: auto-negotiate connection

ike 0:H_Backup: created connection: 0x1409e5e0 18 67.xx.xx.xx->73.xx.xx.xx :500.ike 0: cache rebuild doneike 0: cache rebuild doneike 0:H_Backup: auto-negotiate connection

ike 0:H_Backup: created connection: 0x1409e5e0 18 67.xx.xx.xx->73.xx.xx.xx :500.ike change cfg 1  interface 0 router 0 certs 0  <Manual disable of WAN1 here>ike 0: cache rebuild done

ike 0: HA syncing disabled

ike 0:H: local-addr 173.xx.xx.xxike 0:H: oif 17ike 0:H_Backup: local-addr 67.xx.xx.xxike 0:H_Backup: oif 18

ike 0:RemoteMacOS: local-addr 173.xx.xx.xx

ike 0:RemoteMacOS: oif 17ike 0: policy 2 disabled, ignoring

ike 0: policy 11 disabled, ignoringike 0:internal: add addr 10.xx.xx.0-10.xx.xx.255ike 0: policy 13 disabled, ignoring

ike 0:H: schedule auto-negotiateike 0:H_Backup: schedule auto-negotiate

ike config update doneike 0: cache rebuild done  <ALL VPN DOWN AT THIS POINT, Backup not connecting>

ike 0: cache rebuild doneike 0: cache rebuild doneike 0:H_Backup: auto-negotiate connection

ike 0:H_Backup: created connection: 0x1409e5e0 18 67.xx.xx.xx->73.xx.xx.xx :500.ike 0: cache rebuild done

ike 0: cache rebuild doneike 0:H_Backup: auto-negotiate connection

ike 0:H_Backup: created connection: 0x1409e5e0 18 67.xx.xx.xx->73.xx.xx.xx :500.ike 0:H: carrier downike 0: cache rebuild doneike 0: cache rebuild doneike 0:H: auto-negotiate connection

ike 0:H: created connection: 0x1429dbf0 17 173.xx.xx.145->73.xx.xx.xx :500.

ike 0: cache rebuild doneike 0: cache rebuild done

ike 0:H_Backup: auto-negotiate connection

ike 0:H_Backup: created connection: 0x1409e5e0 18 67.xx.xx.xx->73.xx.xx.xx :500. 

[mahesh_secure]

Hi,

Did you reproduce the issue when taken the log ?

policy 2 ,11 and 13 related to vpn ?

share the below log

config firewall policy

edit 2

show

next

edit 11

show

next

edit 13

show

end

Regards

Mahesh

[sw2090]

hm I do it this way here:

WANs are on WLLB/SDWAN with connectivity checks

There is two tunnels which are always up (execpt if one ISP fails of course).

I have static routes for the subnets I want to reach ovr the vpn (and vice versa if needed).

These routes are redundant - there is one for each vpn. They have the same distance but different priorities. 

Then there is policies for the subnets I need to reach or need to reach me. These have to be redundant too. One or each vpn.

This leads to this:

the tunnel that has the lowest routing prio will be used primary. If that goes down the route with the next higher prio will be used to route the traffic.

This works fine here in 20 locations and 1 central :)

hth

Sebastian