fortigate-ipsec-40-mr3

Redundant VPN configurations Configure the VPN peers - route-based VPN
Configure the VPN peers - route-based VPN
VPN peers are configured using Interface Mode for redundant tunnels.
Configure each VPN peer as follows:
1 Ensure that the interfaces used in the VPN have static IP addresses.
2 Create a phase 1 configuration for each of the paths between the peers. Enable IPsec
Interface mode so that this creates a virtual IPsec interface. Enable dead peer
detection so that one of the other paths is activated if this path fails.
Enter these settings in particular:
Path 1
Remote Gateway Select Static IP Address.
IP Address
Type the IP address of the primary interface of the
remote peer.
Local Interface Select the primary public interface of this peer.
Enable IPsec Interface Mode Enable
Dead Peer Detection Enable
Other settings as required by VPN.
Path 2
Remote Gateway Select Static IP Address.
IP Address
Type the IP address of the secondary interface of
the remote peer.
Local Interface Select the primary public interface of this peer.
Enable IPsec Interface Mode Enable
Dead Peer Detection Enable
Other settings as required by VPN.
Path 3
Remote Gateway Select Static IP Address.
IP Address
Type the IP address of the primary interface of the
remote peer.
Local Interface Select the secondary public interface of this peer.
Enable IPsec Interface Mode Enable
Dead Peer Detection Enable
Other settings as required by VPN.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 153
http://docs.fortinet.com/