fortigate-ipsec-40-mr3

Redundant VPN configurations Creating a backup IPsec interface
Source Interface/Zone Internal
Source Address Name All
Destination Interface/Zone Site_2_B
Destination Address Name All
Schedule Always
Service Any
Action ACCEPT
Creating a backup IPsec interface
You can configure a route-based VPN that acts as a backup facility to another VPN. It is
used only while your main VPN is out of service. This is desirable when the redundant
VPN uses a more expensive facility.
You can configure a backup IPsec interface only in the CLI. The backup feature works
only on interfaces with static addresses that have dead peer detection enabled. The
monitor-phase1 option creates a backup VPN for the specified phase 1 configuration.
In the following example, backup_vpn is a backup for main_vpn.
config vpn ipsec phase1-interface
edit main_vpn
set dpd on
set interface port1
set nattraversal enable
set psksecret "hard-to-guess"
set remote-gw 192.168.10.8
set type static
end
edit backup_vpn
set dpd on
set interface port2
set monitor-phase1 main_vpn
set nattraversal enable
set psksecret "hard-to-guess"
set remote-gw 192.168.10.8
set type static
end
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 173
http://docs.fortinet.com/