2

I have a FortiGate firewall in the main office and some branches with Cisco ASA. An IPsec tunnel runs between the main office and each branch. Some branches have two ISP - main and reserve. For example, building a tunnel between Cisco ASA with one public address and remote Cisco ASA with two public address is a simple task: we can set two remote peers in a crypto map for the device in main office. But we can not to do the same in FortiGate IPSec settings of Phase 2.

How can I solve this task?

Thank you in advance.

0

2 Answers 2

3

This can easily be done by using route-based tunnels and throwing BGP on top so that you can peer with both of the ASAs connections at the same time and use one of the methods that BGP supports for route preference, called AS-path prepending, to “weight” one of the routes so it’s less preferred than the other but will already be visible as a backup route in the event the preferred route disappears (like if the connection is severed).

FortiGates use route-based tunnels by default, though you can enable policy-based tunnels via the Feature Visibility screen. For the ASA side, you will need to run 9.7 or newer versions of ASA OS in order to support VTIs (virtual tunnel interfaces) and to be able to create route-based tunnels.

For examples and details on how to create route-based tunnels and VTIs with BGP on an ASA, you can follow the guide here

2
  • 2
    You don't really need BGP - you could just as well use static routes with according metrics (or OSPF, of course). When a tunnel/link is down, the better route is removed from the FIB and the worse route takes over.
    – Zac67
    Dec 17, 2021 at 5:51
  • 1
    @Zac67 Yeah, you could, but it’s messier that way (at least when you have multiple route advertisements).
    – Jesse P.
    Dec 17, 2021 at 12:03
0

Solved. Here is the decision:

https://docs.fortinet.com/document/fortigate/latest/administration-guide/432685/manual-redundant-vpn-configuration

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.