I'm attempting to setup my 2 testbed Fortigate 40F firewalls 6.4.10 to use their loopback interfaces to terminate a site-to-site IPSec VPN tunnel. The tunnel is currently fully operational on the 40F firewalls when not using loopback interfaces. I'm starting to wonder if terminating both ends of the IPSec VPN tunnel on loopback interfaces is a supported configuration in FortiOS 6.x?
Once this configuration is operational and technically understood in the testbed, the configuration will be implemented on our production firewalls.
WAN ports have static public IPs
FW1 Loopback assigned private IP 10.0.0.1 /29
FW2 Loopback assigned private IP 172.16.0.1 /29
Fortigate doc talks about this configuration, but I must be missing something as it does not work.
You are correct - I just enabled this in the configuration and it laughed at me.
Our need for terminating our site-to-site IPSec VPNs on the lookback interfaces is to cut down on the number of tunnels between sites. If we can terminate the VPN on a loopback interface -at both ends- the multiple ISP connections should be transparent while redundant. This will allow a lower number of BGP peers as-well.
I sort of get the vdom option but was hoping for something a little less complicated since the Fortigate documentation does speak to this loopback option when running in "Profile-based" mode but doesn't provide the actual details. We operate in the newer "Policy-based" mode but think (Hoping) this should still function.
As a side note, we plan to run private IPv6 addressing over the VPN tunnels as-well.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.