SD-WAN | IPSec tunnels

[GIGER]

Greetings,

I am thinking about changing my infrastructure to Fortinet's SD-WAN and I have one question please.

I have 5 branches and 1 HQ.

Each branch has:

- 1 x fixed line internet (DIA) with public WAN IP and

- 1 x 4G internet with private WAN IP that is being nated on one ISP router (not at my premises) to a random public IP address.

- I will install one fortigate in each branch

HQ has:

- 1 x fixed line internet (DIA) with public WAN IP

- I will install one fortigate and one fortimanager

My question is:

How can I establish IPSec tunnels between my HQ DIA and the branches 4G internet links while having the above issues?

Please keep in mind that my ISP can't do any change in my 4G link.

Thanks in advance.

BR

[sw2090]

should be no problem as long as you have static wan ips everywhere. Then on the router you need to have a portforward for 500/UDP (IPSec) and 4500/UDP (NAT-T if you use it) to the FGT  behind the router so IPSec can reach it. Or set HQ to passive mode so it doesn't negotiate the ipsec and have the branch do that. In this case you don't need the port forwards.

On Branch create an sdwan zone to have it switch the tunnels.

Works fine here with static wan ips and s2s ipsec.

There however is issue when you don't have static wan ip somewhere or/and you cannot use s2s.

I am still trying to convice TAC that this is due to bugs in FortiOSes IPSec stack...

[sw2090]

bascially these issues are:

• SDWAN and also the routing daemon seem not to be able to correctly detect the online status of a dialup ipsec resulting in not failing over when that goes down and not switch routes correctly (if you don't use sdwan). 
• if you set an ipsec (S2S aswell as dial up) to passive mode (or even diesabe p1 autonegotiation) and the remote gw is a random ip (so it hase to use ddns as remote gw on this side) then the ipsec stack does not update the ddns which leaves that ipsec with a no longer correct remote gw ip once the ip changes for the first time. So it will go down (due to dpd/keepalive) and not come up anymore until you restart ipsec stack or the fgt

I do have a TAC case open on these but still they haven't even acknowledged that being a bug.