Hi All,
I have a client who we are moving VMware ESX from a Data Centre to the head office. They have FGT's at both ends. Soon to be v7
And we have about 2 VLAN's at the DC we wish to have replicated over to the head office.
Head Office: 192.168.2.0/24
Data Centre: 192.168.100.0/24 (Default VLAN)
Data Centre: 192.168.101.0/24 (VLAN 101) - VMware Vmotion
The customer already has an existing IPSEC tunnel to the Data Centre from the Head Office and vice versa.
If I add the VXLAN as per the cookbook. I am assuming this will break the routing of the existing IPSEC tunnel? I am also assuming that I can run multiple VLAN's over VXLAN?
So should I tell the Head Office Fortigate to route 192.168.100.0/24 & 192.168.101.0/24 to the local VXLAN interfaces? and remove the configuration for the existing IPSEC tunnels?
And when I get this setup, do I just leave the default gateway at the same at both sites? And when a device wants internet access from Head Office on the VXLAN, does it route it over the IPSEC to go out the default gateway at the DC?
I am trying to avoid any potential snags, before deployment. So if anyone has advice/experience that may help. I would be happy to hear it.
Andy
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi Andy
If I were in your position , I would try and _avoid_ the use of VXLAN if its not strictly necessary , expanding Layer 2 networks over large distances is not always the best solution , but I recognize this is sometimes unavoidable.
The main concern is primarily with hardware acceleration , VXLAN acceleration is relatively new on Fortinet HW and only started showing up on NP7 platforms over the last 2-3 years. If you're used to having acceleration on your IPSEC tunnels , using VXLAN may make you lose that benefit , and depending on your use case may impact performance negatively.
If you have fortigate models with decent CPU's onboard , then VXLAN's performance impact may be more or less mitigated if not a huge volume of traffic is expected over the extension.
That being said , there's a good example on how to do this here that doesn't require you to convert your IPSEC tunnel to strictly use VXLAN only. Unicast Traffic could still run over it normally alongside VXLAN since the VXLAN "tunnel" is just established between the IP's set on the IPSEC interfaces in this example below:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-VXLAN-over-IPsec-for-multiple-VLANs-using-...
I hope this helps!
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1547 | |
1031 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.