fully-meshed VPN with Provisioning templates on FortiManager for FortiGates with multiple ISP lines

[Waloo5]

Hello Community,

how to create a fully-meshed VPN with Provisioning templates on FortiManager for FortiGates  with multiple ISP lines and 2 HUBs and multiples Spokes

my architecture is like :

HUB1 ==> 4 ISPs

HUB2==> 4 ISPs

10 Spoke ==> 2 ISPs

my gol is to have in the spoke full mesh to HUBs ( 8 tunnels VPN IPSec  to HUB1 and 8 tunnels to HUB2)

[farhanahmed]

Kindly refer to the doc:

https://community.fortinet.com/t5/FortiManager/Technical-Tip-How-to-create-a-Full-Mesh-IPsec-VPN-wit...

[Waloo5]

Hello, 

Thank you for reply. My question is to know if we can do it in Provisioning templates not in vpn manager.

[farhanahmed]

O I see.

I believe there is no restriction, you should be able to do it but would require some manual work.

I could not find any specific doc for this setup.

But, have separate IPSec templates for HUB1, HUB2 and one template SPOKES.

Use metavariables for interfaces/subnets and create multiple tunnels to each site.

If you want ADVPN, then on Spoke template enable the autodiscovery receive and for Hubs autodiscovery sender.

[Waloo5]

Hello, 

I found a solution to do this, but I'm not sure if it's the recommended approach from Fortinet.

In my SD-WAN Overlay setup, under the 'SD-WAN Overlay Template - Network Configuration (3/5)' section, I added multiple WAN Underlays for the Branch.

In this example, I have 3 ISPs for Hub 1, 3 ISPs for Hub 2, and 2 ISPs for Spokes.

I hope this can help someone who is searching for a solution to this setup. I would also appreciate it if someone has a recommended solution to share it.

Best regards