FortiGate IPSec VPN User Guide - FirewallShop.com

Creating a backup IPSec interface
Redundant VPN configurations
3 Select Create New, enter the following information, and select OK:
Source Interface/Zone
Source Address Name
Destination Interface/Zone
Destination Address Name
Schedule
Service
Action
Internal
All
Site_2_B
All
Always
Any
ACCEPT
Creating a backup IPSec interface
Starting in FortiOS 3.0 MR4, you can configure a route-based VPN that acts as a
backup facility to another VPN. It is used only while your main VPN is out of
service. This is desirable when the redundant VPN uses a more expensive facility.
In FortiOS releases prior to 3.0 MR4, a backup VPN configuration is possible only
if the backup connection is a modem in a Redundant mode configuration.
You can configure a backup IPSec interface only in the CLI. The backup feature
works only on interfaces with static addresses that have dead peer detection
enabled. The monitor-phase1 option creates a backup VPN for the specified
phase 1 configuration.
In the following example, backup_vpn is a backup for main_vpn.
config vpn ipsec phase1-interface
edit main_vpn
set dpd on
set interface port1
set nattraversal enable
set psksecret "hard-to-guess"
set remote-gw 10.10.10.8
set type static
end
edit backup_vpn
set dpd on
set interface port2
set monitor-phase1 main_vpn
set nattraversal enable
set psksecret "hard-to-guess"
set remote-gw 10.10.10.8
set type static
end
FortiGate IPSec VPN Version 3.0 User Guide
104 01-30005-0065-20070716