FortiGate: IPSec peer-to-peer and two remote peers

Question

I have a FortiGate firewall in the main office and some branches with Cisco ASA. An IPsec tunnel runs between the main office and each branch. Some branches have two ISP - main and reserve. For example, building a tunnel between Cisco ASA with one public address and remote Cisco ASA with two public address is a simple task: we can set two remote peers in a crypto map for the device in main office. But we can not to do the same in FortiGate IPSec settings of Phase 2.

How can I solve this task?

Thank you in advance.

Answer 1

This can easily be done by using route-based tunnels and throwing BGP on top so that you can peer with both of the ASAs connections at the same time and use one of the methods that BGP supports for route preference, called AS-path prepending, to “weight” one of the routes so it’s less preferred than the other but will already be visible as a backup route in the event the preferred route disappears (like if the connection is severed).

FortiGates use route-based tunnels by default, though you can enable policy-based tunnels via the Feature Visibility screen. For the ASA side, you will need to run 9.7 or newer versions of ASA OS in order to support VTIs (virtual tunnel interfaces) and to be able to create route-based tunnels.

For examples and details on how to create route-based tunnels and VTIs with BGP on an ASA, you can follow the guide here

Answer 2

Solved. Here is the decision:

https://docs.fortinet.com/document/fortigate/latest/administration-guide/432685/manual-redundant-vpn-configuration