Two IPSec tunnels connected at same time dropping connection on destination

[csantosmachado]

Hi Guys,

I have many sites with two concurrent IPSec tunnels on failover, when primary tunnel falls, secondary assumes incoming connections, however, when primary comes back I get two connections at same time and destination connection falls off.

There's some way FortiGate drop the secondary link and work only with the primary link? I've already set distance and priority, but none of it works.

Thanks in advance and sorry for my bad english.

[gschmitt]

I assume you have two ISPs each connected to wan1 and wan2 and each tunnel uses 1 wan connection, correct?

Do you need your wan2 normally or just as a backup line? You could create a Link Health monitor (Rotuer>Static>Settings) which disables your wan2 if wan1 (or IPSec) is connected.

[csantosmachado]

gschmitt wrote:

I assume you have two ISPs each connected to wan1 and wan2 and each tunnel uses 1 wan connection, correct?

Do you need your wan2 normally or just as a backup line? You could create a Link Health monitor (Rotuer>Static>Settings) which disables your wan2 if wan1 (or IPSec) is connected.

Yes, I have 2 ISPs each one connected to wan1 and wan2. I just need secondary wan as backup. I'd take a look at Health Monitor but I didn't understand how I create a policy that disables my backup ISP. Could you give me a 'how to'?

[gschmitt]

csantosmachado wrote:

Yes, I have 2 ISPs each one connected to wan1 and wan2. I just need secondary wan as backup. I'd take a look at Health Monitor but I didn't understand how I create a policy that disables my backup ISP. Could you give me a 'how to'?

Make sure the Advanced Routing Feature at System > Config > Features is set to On

Now go to Routing > Static > Settings and select Create new (or double click your existing wan1 health link)

Interface wan1

Gateway as needed

Enable Health Check and Ping a server (or your gateway)

Enable Bring Down (Up) Interface and select wan2