Hot!Two IPSec

Author
AbdY
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/06/07 18:38:10
  • Status: offline
2018/06/07 18:47:49 (permalink)
0

Two IPSec

Hello Guys 
 
I have a design that I requires a two VPN connections from my Office to other offices. Some of the remote offices has same IP subnet like Office 1 has subnet 192.168.10.0 and Office 2 has the same subnet
I want to setup two VPN tunnels to each office. one tunnel will be active and the second one will be standby
Also I want to use PBR with these two IPSec but I am not able to figure out how the routing will be 
if I have each office in different subnet i can create two static route (one for each IPSec) and use link monitor to remove the static route from routting table in case first IPSec failed
is there any option PBR in fortigate ?
 
 
thanks in advance 
 
 
#1

5 Replies Related Threads

    Toshi Esumi
    Expert Member
    • Total Posts : 960
    • Scores: 56
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Two IPSec 2018/06/07 22:20:06 (permalink)
    0
    I suggest you follow this thread we had entire today. You seem to have gotten the exact same problem.
    https://forum.fortinet.com/tm.aspx?m=162619&tree=true
     
    #2
    AbdY
    New Member
    • Total Posts : 2
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/06/07 18:38:10
    • Status: offline
    Re: Two IPSec 2018/06/08 11:04:50 (permalink)
    0
    Hello Toshi, 
    Thanks for your feed back
     
    it is almost the same scenario however I have two IPSec tunnels from to each site 
    the overlap is happening on the remote site and  I am wondering if there is a way to use PBR in my case 
    if the first IPSec tunnel for Office one went down that PBR will not be in use and we will use  the second PBR for the second IPSec tunnel (To office one)
     
    Thanks again
     
     
     
    #3
    Toshi Esumi
    Expert Member
    • Total Posts : 960
    • Scores: 56
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Two IPSec 2018/06/08 15:06:32 (permalink)
    0
    Generally policy route can't be mixed with fail-over because policy won't disappear when interface goes down. However, you don't need policy route as long as you use link-monitor over the primary path and remove static routes bound to the vpn interface when link-monitor goes down. There have been many discussion in the forum about link-monitor you can find or search in on-line help or KB.
    #4
    ericli_FTNT
    Gold Member
    • Total Posts : 127
    • Scores: 4
    • Reward points: 0
    • Joined: 2018/02/08 11:12:27
    • Status: offline
    Re: Two IPSec 2018/06/08 15:30:19 (permalink)
    0
    You can configured two phase-1 interfaces as SD-WAN.
    #5
    Toshi Esumi
    Expert Member
    • Total Posts : 960
    • Scores: 56
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Two IPSec 2018/06/08 15:39:01 (permalink)
    0
    I have a question with the SD-WAN option. How do you specify one side as primary and the other side is secondary, or even better, split them granularly like bsed on destination ip ranges or sub-subnets? If you could post links for any documentation for 5.6 or 6.0 that would be supper!
     
    Thanks,
     
    Toshi
    #6
    Jump to:
    © 2018 APG vNext Commercial Version 5.5