Tunnel Aggregation Dial-up VPN

[justin_zhan]

SPOKE Endpoint:
Has two WAN links (wan1 and wan2) with private IP addresses, requiring NAT traversal.
HUB Endpoint:
Has a single WAN link with a public IP address, no NAT traversal required.
Type: "dynamic Dialup user" (Dynamic PPPoE Connection).
Tunnel Aggregation Requirement:
Merge the two existing IPsec tunnels (from SPOKE to HUB) into a single "IPsec Aggregate" tunnel.

The Spoke can only have one tunnel established online at the same time and cannot have two tunnels established online simultaneously.
May I ask what method can be used to establish them simultaneously and complete the tunnel aggregation?

spoke config：

config vpn ipsec phase1-interface
edit "spoke_test1"
set interface "lan3"
set ike-version 2
set peertype any
set net-device disable
set aggregate-member enable
set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256
set localid "88"
set dpd on-idle
set network-overlay enable
set network-id 88
set remote-gw hub address-xxxxx
set psksecret XXXXXXX
set dpd-retryinterval 60
next
edit "spoke2_test2"
set interface "wan"
set ike-version 2
set peertype any
set net-device disable
set aggregate-member enable
set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256
set localid "99"
set dpd on-idle
set nattraversal disable
set network-overlay enable
set network-id 99
set remote-gw hub address-xxxxx
set psksecret XXXXXXXXXXXX
set dpd-retryinterval 60
next
end

config vpn ipsec phase2-interface
edit "spoke_test1"
set phase1name "spoke_test1"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set auto-negotiate enable
next
edit "spoke2_test2"
set phase1name "spoke2_test2"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set auto-negotiate enable
next
end

HUB config：

config vpn ipsec phase1-interface
edit "hub1_test"
set type dynamic
set interface "v707_3003"
set ike-version 2
set peertype any
set net-device enable
set aggregate-member enable
set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256
set localid "88"
set dpd on-idle
set nattraversal disable
set network-overlay enable
set network-id 88
set psksecret XXXXXXXXXX
set dpd-retryinterval 60
next
end

config vpn ipsec phase1-interface
edit "hub2_test"
set type dynamic
set interface "v707_3003"
set ike-version 2
set peertype any
set net-device enable
set aggregate-member enable
set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256
set localid "99"
set dpd on-idle
set nattraversal disable
set network-overlay enable
set network-id 99
set psksecret XXXXXX
set dpd-retryinterval 60
next
end

config vpn ipsec phase2-interface
edit "hub1_test"
set phase1name "hub1_test"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set keepalive enable
next
end

config vpn ipsec phase2-interface
edit "hub2_test"
set phase1name "hub2_test"
set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
set keepalive enable
next
end

[Stephen_G]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

If anyone has any advice to contribute, please do!

Thanks,

[Stephen_G]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks

[AEK]

Hi Justin

Do you mean if tunnel1 goes down then tunnel2 can come up?

By the way I have a suggestion if it can help. I didn't use IPsec aggregate, which is old and very limited, but I used SD-WAN for IPsec and I can tell you that it is 100 times better.

[justin_zhan]

Hi AEK

1. First, I need to implement two WAN links. For example, one is 5 Mbps and the other is also 5 Mbps. 5 + 5 = 10, which means a VPN for two endpoints. If transferring FTP files, the speed can reach 10 Mbps instead of being limited to the single maximum bandwidth of 5 Mbps.
2. Can SD - WAN achieve active - active load balancing instead of active - standby?

                                                                                   Thank you for your support and answers.

[AEK]

Hi Justin

Sure, SD-WAN can do that and many other amazing thing, either managing your WAN links or your IPsec links.

You can start here:

https://docs.fortinet.com/document/fortigate/7.4.8/administration-guide/19246/sd-wan