Immediate IPsec VPN Primary & Secondary Failover

[Mirza_Asad2723]

Hi Team,

I am facing an issue that our some services are cloud based like SAP and i have two WAN links in my FortiGate so that's why I configured two IPsec VPN connections (primary & secondary by using two different WAN links) between Cloud and our FortiGate. I used "Set Monitor" command for failover in secondary IPsec VPN configuration which will monitored primary IPsec VPN connection. I set the two static routes for accessing cloud based server, 1st static route is set for access cloud based server via Primary IPsec VPN connection with AD value is 10 and the priority value is 1, and the 2nd static route is set for access cloud based server via secondary IPsec VPN connection with AD value is 10 and the priority value is 10 to use route when primary down. After that both IPsec VPN connections are working fine and properly auto failover but the issue is that this failover takes few seconds to shift the traffic from primary to secondary which causes our users will disconnect from their established connection from cloud based SAP service. I want to configure this failover will occur immediately without any delay to prevent disconnection issue from cloud based SAP service. Please guide what can i do and how to check failover threshold and is it edible.

FortiGate Model: 201F

Firmware Version: 7.0.10 build0450

[hbac]

Hi @Mirza_Asad2723,

Do you have those tunnels under an SDWAN zone? 

Regards, 

[Mirza_Asad2723]

No, These tunnels are not in the SD-WAN zone.

[xshkurti]

@Mirza_Asad2723  

It seems like you are not using SD-WAN but monitor link with link-monitor to update static routes if any change ocures.

Please try to implement sdwan because it has much better results for your requirements. It can also be adjusted based on your needs.

Technical Tip: Configure IPsec VPN with SD-WAN - Fortinet Community

Regards,

[Mirza_Asad2723]

Hi Concerns,

Is there any alternative to SD-WAN? Making a lot of changes for SD-WAN requires me to wait for downtime. It can't be adjusted through CLI by changing the threshold or check interval. If I set the priority of the secondary route from 10 to 2, will it work? Because two routes are defined, one with AD=10 & Priority=1, and the secondary route with AD=10 & Priority=10. Both routes have the same AD value, only the Priority value is different. Please suggest if this is possible and beneficial.

Further thanks to share your suggestion. 

[Mirza_Asad2723]

can I configure settings to immediately change if, for example, there are 2 ping drops or if the latency becomes too high without disconnecting any sessions. something likewise

[hbac]

@Mirza_Asad2723,

When using 'set monitor', the secondary tunnel will remain down until the primary goes down and it will take a few seconds for the secondary tunnel to be negotiated and up. 

You can use link-monitor instead. Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-Link-monitor/ta-p/197504

Regards, 

[Mirza_Asad2723]

@hbac 

Are you suggesting using 'set monitor' along with 'link-monitor'? Can both be used simultaneously without any conflicts? Because, as per my understanding, both serve a similar purpose. Additionally, to the best of my knowledge, 'set-monitor' doesn't shift to the secondary link until the primary link is down. Link-monitor, on the other hand, not only monitors link status but also examines latency and packet loss. If there is significant latency or packet loss, it considers the primary link as down and activates the secondary link. Am I correct in my understanding?

Please confirm.

[hbac]

@Mirza_Asad2723,

Your understanding is correct. However, I didn't suggest to use both. I suggested to use link-monitor as you want to failover if there are 2 ping drops or if the latency becomes too high. 

Regards, 

[pbangari]

You can try 'unset monitor' under IPSec configuration and use link-monitor instead as in this case both the primary and secondary tunnels will be up and traffic failover should happen much quicker.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-VPN-Site-to-Site-tunnel-monitor/ta-p...