Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Arnold
New Contributor

backup vpn on backup modem interface

Hi,

we are trying to config two sites with main ISP and a backup modem 3g (set as Redundant) with redundant VPN 

and I have no Idea how to do that, I found some article's but they are for live connections

https://www.youtube.com/watch?v=01KEgxqC4WI

http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%25205.0%2520Help/redundant-tunne...

 

right now we have a policy based hub and spoke topology with a 3g redundant modem, to connect when there is wan1 ping loss 

 

MCSE

MCSE
6 REPLIES 6
emnoc
Esteemed Contributor III

That should be easy & trivial with 3g-usb modem and setting the distance or priority lower than the main path. Just config the modems and set this  redundant or always connected but ensure the priority is lower for the celluar path.

 

You will need dead-gateway  or link detect to ensure routes are lower upon the main path failure.

http://socpuppet.blogspot...d-with-huawei-and.html

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Arnold
New Contributor

Hi,

making a backup on 3g was easy, making the VPN is the hard part

MCSE

MCSE
emnoc
Esteemed Contributor III

Once again trival and easy if it's route-based.

 

 

1: You create 2 vpns, one over the main path src'ing that vpn with that interface, and  one vpn sourced using the wan-modem interface.

 

2: Set the routes for the dstsubnet to be lower priority for path you want to use

 

3: enable DPD over the vpns

 

4: enable the vpn monitor

 

5: make sure correct fwpolicies exist for traffic carried in the vpn

 

is that clear? and what your trying todo?

 

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Arnold
New Contributor

that VPN in site 1 wuld work if the main isp is down and vice versa

MCSE

MCSE
emnoc
Esteemed Contributor III

Okay you need three vpns (  the drawing helps a lot on your topology )

 

I never did that ( 3 vpns ) since I used mpls to backup against a private cloud ( MPLS ) using a 3g cellaur in a private APN, but I guess you could set priority over the routes on vpn#1 ( main )  vpn#2 ( 3g to main ) or vpn#3 ( 3g to 3g ) to achieve the forwarding path that you want to achieve.

 

Running a dynamic routing protocol might be better, but  you could easily abuse and use up your bandwidth limits on  the  3g celluar usage with the misc ospf  and other  leaked  traffic if you have low monthly allowance this could lead to a high bill.

 

( e.g we had one site that had a 378.00 bill since we went over our monthly allowance.....ouch )

 

Back on point, if you need all 3 vpns what I would do;

 

 

 

run ospf across  vpn#1 

set static routes on vpn#2 and #3 with the distance  weight below that of the OSPF administrative cost

than set vpn monitoring for the vpn  interface on vpn#3  ( set monitor vpn#2 ) . I'm not sure if you can run 2 monitored vpns in one monitor

 

This will allow for quick conversion, eliminate any dynamic routing on  the backups and allow monitoring between the backups. Just run  DPD on all devices and you should be golden ;)

 

Remember to set a floating static route that less preferred than the  main interface or main vpn path.

 

 edit: you might be able to set a backup vpn statement on vpn#2 ( against  vpn#1 ) and vpn#3 ( against #1 ). That would bring up both  vpns if the main vpn goes down. You just have to play around with it.

 

 

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Arnold
New Contributor

thanks a lot, I will try to doing that 

MCSE

MCSE
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors