Route Policy in Dynamic VPN Tunnel

[GonzaloArroyoRey]

Hello Everybody

I have several firewalls Fortigate F60D/F60E worldwide and central F200E configured as HUB-spokes and have BGP as routing protocol so, remote firewalls can set up dynamic VPN's and communicate their internals network.

My question is if it is possible to configure a Route Policy using this scenario, I tried to configure it but it only allow me physicals interfaces or tunnels-manually configured

best regards

Gonzalo

[Toshi_Esumi]

Do you have only one dialup IPsec phase1-interface on the HUB side and terminating all IPSecs from other FGTs? You probably need to separate the phase1-interface for each peer to set policy routes.

But BGP generally doesn't work well with policy routes because it always decides the best path for one destination prefix unless you use tricks described below:

https://www.noction.com/blog/equal-cost-multipath-ecmp

To make policy routes to work you need to have multiple parallel routes in your routing table ("priority" can be different), like two 0/0 routes pointing to two ISPs and a policy route specify one of them.