Dual IPSec to same subnet for redundancy

[whyouwannaknow]

Hello,

We have a site called A and a site called B. On the A site, we have two different ISP router and on the B site, we have a Fortigate firewall. We have for the moment a site to site VPN IPSec. Site A has a LAN 10.10.0.0/16 and site B has a LAN 10.20.0.0/16

What we want to do, is two IPSec tunnel from site A to site B (so 10.10.0.0/16 to 10.20.0.0/16 on both VPN) for redundancy purposes.

The thing is, since on site A we have two ISP, we do have two WAN IPs, but on site B, we have a single WAN IP. So both IPSec VPN will go to the same WAN IP on our fortigate (located on site B).

Is that possible to do? If so, can we implement this in a failover and/or in a load balancing topology?

Do I need to implement GRE tunnels over IPSec for routing purposes?

Thank you for all the help!

PS: On site A we have a WAN load balacing, by the way.

[sw2090]

basically you could have two tunnels to the same remote gateway.

On site B you will have to make sure that the Fortigate can differ  the tunnels.

Give them different proposals or/and set them to a specific peer id.

Also they have to have the specific remote gateway.

Then create two tunnels on Side A with different WAN and same remote gw.

The easiest thing then is to put both tunnels into a zone because then you only need to make the policies for the zone and not for every single tunnel. This must be done on both sides.

Then the most easiest way is the create redundant static routing for the needed remote subnet(s). That is you have a route to a subnet for every tunnel with same distance and different priority. This also has to be done on both sides.

this makes sure the traffic always uses the route with the lowest priority - except if this is gone down, then it will use the one with the next higher prio.

This is only one sulition, there may be others ;)

[isamt]

If you want site B to have a primary tunnel to site A and have the other tunnel as failover in the event that the primary vpn tunnel goes down this is very easy to do.

At site A

=======

Create tunnels

primary_2_site_B

secondary_2_site_B

create Zone site_B_tunnel

add tunnels primary & secondary

create static routes

10.20.0.0/16 next hop tunnel primary metric 10

10.20.0.0/16 next hop tunnel secondary metric 20

create rules

site_B-tunnel to site_A

site_A to site_B-tunnel

At site B

=======

Create tunnels

primary_2_site_A

secondary_2_site_A

create Zone site_A_tunnel

add tunnels primary & secondary

create static routes

10.10.0.0/16 next hop tunnel primary metric 10

10.10.0.0/16 next hop tunnel secondary metric 20

create rules

site_A-tunnel to site_B

site_B to site_A-tunnel

Now if at site B ISP1 goes down

route to site A with metric 10 automatically removed from routing table and traffic switches to ISP2 tunnel.

At site A same thing happens, primary tunnel route removed from routing table and traffic automatically switch to secondary tunnel.

When ISP1 at site B comes back up, traffic automatically fails back to the primary tunnel.

Simples