FortiGate IPSec VPN User Guide - FirewallShop.com

Redundant VPN configurations
Configuration overview
Redundant VPN configurations
This section discusses the options for supporting redundant and partially
redundant IPSec VPNs, using route-based approaches.
The following topics are included in this section:
• Configuration overview
• General configuration steps
• Configure the VPN peers - route-based VPN
• Redundant route-based VPN configuration example
• Partially-redundant route-based VPN example
• Creating a backup IPSec interface
Configuration overview
A FortiGate unit with two interfaces to the Internet can be configured to support
redundant VPNs to the same remote peer. If the primary connection fails, the
FortiGate unit can establish a VPN using the other connection.
A fully-redundant configuration requires redundant connections to the Internet on
both peers. Figure 16 on page 84 shows an example of this. This is useful to
create a reliable connection between two FortiGate units with static IP addresses.
When only one peer has redundant connections, the configuration is partiallyredundant.
For an example of this, see “Partially-redundant route-based VPN example”
on page 98. This is useful for to provide reliable service from a FortiGate unit with static IP
addresses that accepts connections from dialup IPSec VPN clients.
In a fully-redundant VPN configuration with two interfaces on each peer, four
distinct paths are possible for VPN traffic from end to end. Each interface on a
peer can communicate with both interfaces on the other peer. This ensures that a
VPN will be available as long as each peer has one working connection to the
Internet.
You configure a VPN and an entry in the routing table for each of the four paths.
All of these VPNs are ready to carry data. You set different routing distances for
each route and only the shortest distance route is used. If this route fails, the route
with the next shortest distance is used.
The redundant configurations described in this chapter use route-based VPNs,
otherwise known as virtual IPSec interfaces. This means that the FortiGate unit
must operate in NAT/Route mode. You must use auto-keying. A VPN that is
created using manual keys (see “Manual-key configurations” on page 111) cannot
be included in a redundant-tunnel configuration.
FortiGate IPSec VPN Version 3.0 User Guide
01-30005-0065-20070716 83