SD-WAN redundant routing question

[James_G]

I have a high level question if a scenario is possible.

I have 2 main head office sites, with a traditional MPLS link connecting the 2, lets call them site A and site B, each site also has a leased line for internet access. Each site has a 300D HA pair for corporate firewall.

I also have remote offices with a DSL internet connection and VPN connectivity to site A, using Fortigate 60E DSL.

Is it possible to configure resilient VPN connectivity / SD-WAN so that if the internet leased line to site A fails, the remote office can still access resources on site A, via VPN to site B and across MPLS?

Each site has unique internal address, lets say 10.1.x.x/16 for site A, 10.2.x.x/16 for site B and 10.3.x.x/16 for remote site, the routing on the MPLS forwards traffic for 10.3.x.x/16 to site A, as traffic is expected to route from this firewall / VPN endpoint, traffic from site B to remote site is required so I can't change MPLS routing.

It's all a bit blue sky thinking right now, wondering if anyone has done the same.

[Toshi_Esumi]

I'm not sure how SD-WAN fits in your situation while FGT's SD-WAN is mainly focusing on multiple/redundant connectivity & monitor/control for Cloud-resources. I don't have any experience how it would control traditional VPN traffic&redundancy over it. Somebody else might be able to answer.

But your situation is a traditional dynamic routing situation. What we do for that kind of situation (actually that's our business) is to set up dynamic routing protocol, specifically eBGP among all three locations over MPLS connectivity including VPNs so that we can manipulate preference one path over the other using communities, which we can't do with OSFP.

But if you haven't dealt with any routing protocol and strictly been using static routes, I would set two static routes for the same destination like 10.3/16 with different distance or priority to both VPNs. When the primary site-A VPN comes down, the secondary site-B VPN route would be used. 

[Toshi_Esumi]

Actually that covers only one direction. You also need to set another set of static routes with different distance or priority to get back to the remote location from the Site-A: one toward the direct VPN for primary, and another toward Site-B for secondary.

That's the reason we use BGP. It's automatic.

[Toshi_Esumi]

And, of course, Site-B needs to have a static route for the remote location toward the VPN.

[James_G]

Hi,

You are correct i have very little experience of BGP, it's managed for me on the MPLS, and on my kit I just use static routes.

I think I have a solution:

**I am going to create an additional VPN between site A and site B across the MPLS, but not having any static routes across the VPN for site to site traffic.

**I then create VPN between remote site and each of site A and site B across internet, have weighted routes at site A traffic to remote site over least cost / distance direct VPN, higher cost / distance route over the site A-B VPN, have have weighted routes at remote site a traffic to site A over least cost / distance direct VPN, higher cost / distance route to site B.

**I then create policy based routes at site B that everything ingress from site AB VPN route to remote site VPN, everything ingress from remote site VPN route to site AB VPN.

Worst case scenario is that traffic from site B to remote site needlessly has to cross the MPLS twice if the failover is in affect, but I don't have to change routing on MPLS and *I think* it will work.