Redundant internet/S2S VPN - need some assistance

[EricTheGreat]

Greetings.  Here is my situation, and I would like some suggestions.

We have 2 branch offices. 

Branch office 1 has a FortiGate 100F, and 2 internet connections, different ISP's (WAN1 and WAN2 respectively). Branch office 2 also has a FortiGate 100F, but only ONE internet connection (WAN1).

I would like to accomplish the following:

1. Branch 1 failover internet connection - when WAN1 goes down, traffic is pushed over to WAN2. When WAN1 is restored, traffic jumps back over to WAN1.  Essentially make WAN2 a backup connection...only activated if WAN1 fails.

2. Site-to-site VPN connection between the 2 sites, but with redundancy.   So, if 1 of the 2 internet connections goes down at branch office 1, the site-to-site VPN will not be disrupted.

What is the best way to accomplish this?  SD-WAN..priorities....CLI magic?

I'd appreciate some assistance!

Thank you for your time!

[M_M_SW]

you can use SD-WAN

Combine two lines wan1 wan2 and two VPNs at the same time

use SD-WAN Rules to make it Priority order or redundancy

[EricTheGreat]

When you say combine the two VPNs at the same time, what exactly do you mean?

[ede_pfau]

You can SLA not only physical lines but VPNs as well.

You need to create 2 s2s VPNs (as you have 2 different public IPs on one side) of which one will be 'muted' by attaching a higher cost. This can all be done in the SD-WAN setup.

Sorry, no magic needed.

[EricTheGreat]

I greatly appreciate your response.  Do I need to be on a certain version of FortiOS to see those options?  I am on 6.0.9.  Have been a little weary about upgrading to 6.2.x series as I heard it's been plagued with issues.

[ede_pfau · Accepted solution]

Should be possible in v6.0 as well. I wouldn't put v6.2.x into production yet either.

[EricTheGreat]

So, when I go to enable the SD-WAN interface and add members, I should add WAN1, WAN2, and then both VPN tunnels all at the same time? So...4 members total?....I apologize for my ignorance and greatly appreciate your continued assistance. 

[James_but_online]

That is correct. WAN1 and WAN2 interfaces and then the 2 Tunnel Interfaces. Then use SDWAN rules to get the results you want to achieve with the fail-over. SDWAN rules are top down priority. 

[Aads]

Hi,

Find helpful link below,

https://kb.fortinet.com/kb/documentLink.do?externalID=FD41297

Regards

Aads

[Aads]

Hi Eric,

I would say this is achievable even without SD-WAN. You can use a routing protocol to manipulate the traffic. You will have to create the below IPSEC tunnels,

FG01_WAN01 <-> FG02_WAN01

FG01_WAN02 <-> FG02_WAN01

Use a dynamic protocol like BGP over the IPSEC tunnels. Then you can manipulate BGP routes using attributes such as local preferences or AS-PATH prepending. 

You can also use SD-WAN. In which case in Branch office one you will have 2 IPSEC interfaces members in the SD-WAN interface. You can create SD-WAN policies to prefer one tunnel over the other. In this case, you could either you a dynamic routing protocol or static routes. 

Hope it helps. 

Regards

Aadhil