Hi Guys, i need to configure a vpn site-to-site between Fortigate100E in HA and Azure . The Fortigate is set with 2 wans in load balancing .
I want to know how to configure this vpn from the Firewall with two wans to Azure Cloud , in such a way that to have a high reliability of the vpn (in case one of the line is down the vpn is routed to the other active line) .
Firmware version of two firewalls is 6.0.2
thanks for your support
Antonio
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi tony85,
in my environment (dealing with two fortigates) what I did to configure a vpn failover is configuring two identical vpns (on the fortigate side), one with interface set to wan1 and the other with wan2.
Once done that, if you edit the backup vpn through the cli, there is a setting "set monitor ' '" which allows you to set the failover vpn in monitor mode with respect to the other one.
So for example:
- VPN-Headquarter (wan1)
- VPN-Backup (wan2)
Enter the cli:
- config vpn ipsec phase1-interface
- edit VPN-Backup
- set monitor 'VPN-Headquarter'
-end
Done that, you will se up only the primary one. If the wan1 interface goes down, the backup one will come up.
Hopefully this configuration will help you.
Eleonora
Hi tony85,
in my environment (dealing with two fortigates) what I did to configure a vpn failover is configuring two identical vpns (on the fortigate side), one with interface set to wan1 and the other with wan2.
Once done that, if you edit the backup vpn through the cli, there is a setting "set monitor ' '" which allows you to set the failover vpn in monitor mode with respect to the other one.
So for example:
- VPN-Headquarter (wan1)
- VPN-Backup (wan2)
Enter the cli:
- config vpn ipsec phase1-interface
- edit VPN-Backup
- set monitor 'VPN-Headquarter'
-end
Done that, you will se up only the primary one. If the wan1 interface goes down, the backup one will come up.
Hopefully this configuration will help you.
Eleonora
Hi Eleonora, thanks for your help.
On the remote site, have you also indicate the second pubblic ip of the WAN2 (VPN-Backup ) ?
thanks
Yes. Actually now that I thought about it, it worked also between a Fortigate and a PFSense. I've configured the same two vpns on the PFSense, one for the headquarter and one for backup (so one for the public ip of wan1 and the other for wan2). They were identical besides the remote gateway.
thanks to all, now I just have to find out if Azure allows this configuration
thank you guys, now i just to discover if Azure support this configuration ;)
Hi Guys, I managed to establish the site-to-site vpn between my firewall and azure, now i have other problem i want to reach the VM Azure, also via vpn client but for now it is unreachable .
Can you Help me ?
thanks
Antonio
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1516 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.