fortigate-ipsec-40-mr3

Configuration overview Redundant VPN configurations
The configuration described here assumes that your redundant VPNs are essentially
equal in cost and capability. When the original VPN returns to service, traffic continues to
use the replacement VPN until the replacement VPN fails. If your redundant VPN uses
more expensive facilities, you want to use it only as a backup while the main VPN is
down. For information on how to do this, see “Creating a backup IPsec interface” on
page 173.
Figure 22: Example redundant-tunnel configuration
Site_1
FortiGate_1
FortiGate_
Redundant tunnel
Primary tunnel
FortiGate_2 rtiGate_2
Site_2
A VPN that is created using manual keys (see “Manual-key configurations” on page 183)
cannot be included in a redundant-tunnel configuration.
General configuration steps
A redundant configuration at each VPN peer includes:
one phase 1 configuration (virtual IPsec interface) for each path between the two
peers. In a fully-meshed redundant configuration, each network interface on one peer
can communicate with each network interface on the remote peer. If both peers have
two public interfaces, this means that each peer has four paths, for example.
one phase 2 definition for each phase 1 configuration
one static route for each IPsec interface, with different distance values to prioritize the
routes
two Accept security policies per IPsec interface, one for each direction of traffic
dead peer detection enabled in each phase 1 definition
The procedures in this section assume that two separate interfaces to the Internet are
available on each VPN peer.
IPsec VPNs for FortiOS 4.0 MR3
152 01-434-112804-20120111
http://docs.fortinet.com/