I'm in need for some design guides and ideas.
I have a few Fortigates in different Offices. All of them have an internet connection and sometimes a backup line.
All locations have a vpn tunnel to the HQ and a static 10.0.0.0/16 route which points to the vpn-interface.
The HQ is doing the routing and spreads the /24 or /23 toward the branch offices vpn tunnel interface(s).
So far everything is working but it's not looking nice
My Idea is to use OSPF or BGP between those locations, but i'm unsure how to set it up
Generaly I would put all those FGT into area 0. If we have a "sub-network" attached in a branch, that would get an other area.
But since we don't have all those FTG in the same subnet and don't have a full-mesh...
The current plan is to use HQ as area 0 and put each branch into a different area.
The ipsec tunnel interfaces between HQ and branches get their own /30 subnet.
HQ will announce the /16 network towards a branch and the branch announces the local /24 or /23 towards HQ.
By this I can get rid of the static /24 routes towards the branches
Is it possible to have an area 0 with just one fortigate and no other routers?
If Branch A has two ISPs, there are two VPN Tunnels between HQ und Branch A.
a) Do I use one area and a /30 subnet for each tunnel?
b) Do I use a /30 for the tunnel and put both interfaces into the same area
c) Do I use a /29, but all 4 ipsec interfaces in the same subnet and use one area for this branch?
My gut tells me to go for solution b
are there any other ways to achiev more or less the same? What are the pro and cons in this approach?
Anything i forgot?
There are some design changes in the future.
e.g some branches get voice and all branches with voice, get a full-mesh-vpn setup. voice and data traffic between branches those branches does
not go over HQ anymore. I'll have to find a way for that as well, but this is a problem for future-me :)