VPN failover between ASA' s

[dwaynepeeters]

Hello, I am doing a research looking for the best possible solution for a failover between two Fortigate' s and was hoping someone would like to point me in the right direction. The situation is as follows, we have got: - 2 Headquarters: Each is equiped with an Fortigate - 10 Branchoffices: Each is equiped with an Fortigate Each branchoffice needs to have a redundant VPN connection to both headquarters, and they all need to use the first one as the primary and the other one as the secundary. In case of a failure, all branchoffices need to use the second VPN connection going to the second headquarter. In my research I am looking for the best possible solution, with the quickest failover. VoIP is being used on the network were there are callmanagers in both HQ' s, so it is of utmost importance that the failover is very rapid, so the ipphones in the branches can failover instantly. Cisco has something called " Dynamic Multipoint VPN (DMVPN)" were a routing protocol like EIGRP or OSPF is running over a IPsec/GRE tunnel were both VPN tunnels are always online which eliminates the need to failover. In this case the only thing which needs to failover are the IPphones themselves. I was wondering if Fortigate has a similar functionality, and am hoping someone could point me in the right direction? Thank you very much in advance, Kind regards Dwayne

[romanr]

Hi, like often there are multiple ways to reach this goal. In my opinion using OSPF with IPSec interface mode works best would be quite similar to the Cisco approach. If you search for OSPF and IPsec you will find a couple of threads.. Here is a link to the knowledge center targetting this scenario: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=100140&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=38402385&stateId=0%200%2038400929 If think there might be an example in either the Fortinet Cookbook or the Fortigate Admin guide as well -> So have a look at those docs on docs.forticare.com! best regards, Roman

[ede_pfau]

that' s a typo, documents are on http://docs.fortinet.com . As to the VPN failover, as IPsec VPNs are virtual network interfaces in FortiOS you could use Dead Gateway Detection w/ ping servers to have the FGTs detect if a VPN goes down and switch over immediately. Of course, the secondary VPN should be up all the time (keyword: auto-negotiate). That should be quicker than a routing protocol. When failing over, the FGT will adjust it' s active routing table accordingly. Then again, there' s a CLI-only feature by which one VPN tunnel monitors another one and steps in if the other fails. As I haven' t used it yet I cannot tell if it supersedes the interface/gateway detection or if it supplements it. You' ll find the parameter and some clues in the CLI Guide.

[dwaynepeeters]

Thank you very much for the fast replies. -Romanr: Your suggestion of using OSPF with IPSec could be a good solution, because it seems to be exactly thesame as DMVPN. The only drawback of it is that it uses OSPF instead of EIGRP, were EIGRP is a bit faster than OSPF. Also EIGRP is better suited for our network design. Can Fortigates do EIGRP? -ede_pfau: I don' t think Dead Gateway Detection w/ ping servers will be faster than a routing protocol in this situation: With a routing protocol you can in fact eliminate the failover. Because both VPN tunnels stay in the routing table, the only thing that needs to failover are the IPphones themselves to the other HQ. Please correct me if i' m wrong. (Also, do you perhapse have the name of the " CLI-only feature" , because I' d like to dive a bit into that feature as well) Kind regards, Dwayne

[ede_pfau]

OK, I' m working with static routes for IPsec VPN connections. I' ve got both tunnel routes configured, with the backup tunnel having a higher Priority (this is FortiSpeak for " cost" ). This way, only the active route stays in the active routing table (Routing Monitor) with no need for a routing protocol. The parameter I mentioned is called " monitor-phase1" . It protects one VPN tunnel from a failure of the corresponding primary interface. Monitoring a phase2 doesn' t make sense really, I should have noticed that. CLI Guide pg. 638.

[emnoc]

Your suggestion of using OSPF with IPSec could be a good solution, because it seems to be exactly thesame as DMVPN. The only drawback of it is that it uses OSPF instead of EIGRP, were EIGRP is a bit faster than OSPF. Also EIGRP is better suited for our network design. Can Fortigates do EIGRP?

Your mistaken, DMVPN has no requirement to use OSPR,EIGRP or RIP over the dynamic tunnels. In your case, deploy OSPF over interface-mode ipsec tunnels and you could have redundant tunnels and quickfailover. You could adjust your ospf timers if needed to get the quick failover interval. btw we run OSPF over our DMVPN tunnels, EIGRP is not going to be a option for you.