Hello,
I'm trying to improve my setup.
I have a new Fortigate units with 2 ISP: 1 primary and 1 backup under FortiOS 7.2.3.
So I followed this https://docs.fortinet.com/document/fortigate/7.2.2/administration-guide/431448/sd-wan-overview in order to add my wan1 and wan2 into virtual-wan-link. I configured a cost 0 on WAN1 and a cost 10 on WAN.
I added the default static route through virtual-wan-link. However, I cannot manage the distance and priority of this route and I'm not sure my VPNs (IPSEC + SSL) will continue to work.
When I created a VPN (without SDWAN), I used to create a static route to the VPN interface with a lower distance than my default route.
But now, I can only create a static route with the same priority. Will it work ?
I read this https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-IPsec-VPN-with-SD-WAN/ta-p/20984... but not sure if it's mandatory ?
Unfortunately I cannot test right now. I need to create and prepare my setup before going into production. So i wonder if anyone already experiment a setup like mine:
Do I need to configure something more or review my priority to get my VPNs working along my new SD Wan setup.
Let me know if you need more info or if it's not clear.
Thanks !
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi,
After our exchange in MP, the fortigate use the most strict route for your trafic vpn in your routing table.
You can close this post, if it's okay for you
have a nice day
Hello RDM,
I have almost the same configuration as you, but with a centralized Internet output and advpn.
I recommend that you use the SDWAN Rules and SLA as indicated in the last link you put in order to ensure that the flow goes through the link you want.
I use this feature to distribute my load between my 2 vpn links for example.
Hi Julien,
Thanks for your answer.
So I would need to configure SD WAN rules for my IPSEC + VPN SSL + VIP traffic ?
However, I don't know what to create ? Do you have any example for me ?
Hi, SdWan rules only for your outboung traffic. VPN SSL or VIP are allowed in your wan1 interface.
Best Regards,
Julien
Ok same for IPSEC, i guess ? So I don't need to do anything ?
What about my static route to my remote subnet which cannot be "before" my default one ?
Hi,
After our exchange in MP, the fortigate use the most strict route for your trafic vpn in your routing table.
You can close this post, if it's okay for you
have a nice day
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1688 | |
1087 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.