config vpn ipsec phase1-interface
edit "name of connection"
set interface "wan1"
set ike-version 2
set keylife 28800
set peertype any
set proposal aes256-sha512
set negotiate-timeout 15
set dpd on-idle
set dhgrp 14
set remote-gw <WAN IP of opposite FGT Interface the S2S is connected to there>
set psksecret ENC .... (encrypted key - you can set it cleartext on cli but it will be saved encrypted in config)
set dpd-retryinterval 5
next
end
config vpn ipsec phase2-interface
edit "name of phase2"
set phase1name "connecton name you set above"
set proposal aes256-sha512
set dhgrp 14
set auto-negotiate enable
set keylifeseconds 14400
next
end
Then create a 2nd S2S with different remote gw and interface analog to this.
config router static
edit 0
set dst destination-subnet destination-subnetmask
set priority 20
set device "your S2S #2"
next
edit 0
set dst destination-subnet destination-subnetmask
set priority 10
set device "your S2S #1"
next
end
Order of the routes in here does not count! The prio defines the order they get used in!
edit 0 in FortiOS means that FortiOS will give it an autoincremented number and you don't have to care for if that alredy exists and would be overwritten.
destination-subnet and destination-subnetmask are the same in both routes.
Then do the same on the other Side. Just set the route destination to the subnet of the opposite site.
Then both sides need policies to allow the traffic you need to flow. No IPSec will come up without policies on a FGT!
You will have to have either redundant policies (one for each S2S) or you will need multiple destination/source interfaces in your policy (which will disable the interface group view in gui).
post edited by sw2090 - 2021/01/28 06:51:12