Help
FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
nvisentin_FTNT
Staff
Staff

Created on ‎05-27-2015 05:56 AM Edited on ‎02-05-2024 09:53 AM By Moderator

Article Id 198749

Technical Tip: WAN Optimization over redundant IPsec tunnels

Description

This article describes the steps to configure FortiGate WAN Optimization in a redundant WAN scenario using two IPSec tunnels.

It includes the network diagram, requirements, and configuration of all FortiGate units.  It can also apply to any other redundant WAN architecture without IPSec tunnel.  This setup is based on Active/passive WAN optimization using authentication group.


Solution

The following network diagram illustrates this example and how to setup WAN Optimization over redundant IPSec tunnels.
nvisentin_FD36592_tn_FD36592-1.jpg

Configuration CLI (only relevant parts)

FGTClient VPN IPSEC config

config vpn ipsec phase1-interface
    edit "Secondary-p1"
        set interface "wan1"
        set proposal aes256-sha1
        set remote-gw 172.31.17.37
        set psksecret ENC ...
    next
    edit "Primary-p1"
        set interface "wan2"
        set proposal aes256-sha1
        set remote-gw 172.31.193.37
        set psksecret ENC ...
    next
end   

config vpn ipsec phase2-interface
    edit "Secondary-p2"
        set auto-negotiate enable
        set phase1name "Secondary-p1"
        set proposal aes256-sha1
    next
    edit "Primary-p2"
        set auto-negotiate enable
        set phase1name "Primary-p1"
        set proposal aes256-sha1
    next
end

FGTClient zones : VPN interfaces and LAN interfaces are put into zones

config system zone
    edit "VPN"
        set interface "Primary-p1" "Secondary-p1"
    next
    edit "LAN"
        set interface "lan"
    next
end

FGTClient routing config

config router static
    edit 1
        set device "Primary-p1"
        set dst 10.112.0.0 255.255.252.0
    next
    edit 2
        set device "Secondary-p1"
        set distance 20
        set dst 10.112.0.0 255.255.252.0
    next
end

FGTClient WANOPT config

config wanopt settings
    set host-id "client"
end

config wanopt auth-group
    edit "wanopt-auth"
        set auth-method psk
        set psk ENC …
    next
end

config wanopt profile
    edit "wanopt-profile"
        set auth-group "wanopt-auth"
            config http
                set status enable
            end
            config cifs
                set status enable
            end
            config ftp
                set status enable
            end
            config tcp
                set status enable
                set port 22
            end
end

FGTClient Firewall policy

config firewall policy
    edit 1
        set srcintf "LAN"
        set dstintf "VPN"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set wanopt enable
        set comments "WAN OPT to Server"
        set wanopt-profile "wanopt-profile"
    next

FGTServer VPN IPSEC config

config vpn ipsec phase1-interface
    edit "Secondary-p1"
        set interface "port1"
        set proposal aes256-sha1
        set remote-gw 172.31.16.178
        set psksecret ENC …
    next
    edit "Primary-p1"
        set interface "port3"
        set proposal aes256-sha1
        set remote-gw 172.31.192.178
        set psksecret ENC …
    next
end
config vpn ipsec phase2-interface
    edit "Secondary-p2"
        set auto-negotiate enable
        set phase1name "Secondary-p1"
        set proposal aes256-sha1
    next
    edit "Primary-p2"
        set auto-negotiate enable
        set phase1name "Primary-p1"
        set proposal aes256-sha1
    next
end

FGTServer zones : VPN interfaces and LAN interfaces are put into zones

config system zone
    edit "VPN"
        set interface "Primary-p1" "Secondary-p1"
    next
    edit "LAN"
        set interface "port5"
    next
end

FGTServer routing config

config router static
    edit 1
        set device "Primary-p1"
        set dst 10.156.0.0 255.255.252.0
    next
    edit 2
        set device "Secondary-p1"
        set distance 20
        set dst 10.156.0.0 255.255.252.0
    next
end

FGTServer WANOPT config

config wanopt settings
    set host-id "client"
end

config wanopt auth-group
    edit "wanopt-auth"
        set auth-method psk
        set psk ENC ...
    next
end

FGTServer WANOPT tunnel policy

config firewall policy
    edit 5
        set srcintf "wanopt"
        set dstintf "LAN"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
    next
end

FGTServer : WAN Optimization passive policy to allow optimized traffic from client side toward server side

config firewall policy
    edit 3
        set srcintf "VPN"
        set dstintf "LAN"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set wanopt enable
        set wanopt-detection passive
    next
end

Verification of Configuration and troubleshooting

FGTClient: Verify route toward server subnet (10.112.0.0/22)

FGTClient # get router info routing-table database
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       > - selected route, * - FIB route, p - stale info
 
S    *> 0.0.0.0/0 [10/0] via 172.31.19.254, wan1
S       10.112.0.0/22 [20/0] is directly connected, Secondary-p1
S    *> 10.112.0.0/22 [10/0] is directly connected, Primary-p1
C    *> 10.156.0.0/22 is directly connected, lan
C    *> 50.10.10.0/24 is directly connected, dmz
C    *> 172.31.16.0/22 is directly connected, wan1
C    *> 172.31.192.0/22 is directly connected, wan2

FGTServer: Verify route toward client subnet (10.156.0.0/22)

FGTServer # get router info routing-table database
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       > - selected route, * - FIB route, p - stale info
S    *> 0.0.0.0/0 [10/0] via 172.31.19.254, port1
C    *> 10.112.0.0/22 is directly connected, port5
S       10.156.0.0/22 [20/0] is directly connected, Secondary-p1
S    *> 10.156.0.0/22 [10/0] is directly connected, Primary-p1
C    *> 172.31.16.0/22 is directly connected, port1
C    *> 172.31.192.0/22 is directly connected, port3

WAN optimization verification (GUI interface is available under the version 5.0)

•  Send HTTP, SSH, FTP traffic from the client toward the server.

•  The Wan Optimization statistics can be monitored from the GUI (Web Based Manager), at WanOpt. --> Monitor :
nvisentin_FD36592_tn_FD36592-2.jpg
GUI interface WAN Optimization

CLI verification :

FGTClient # diagnose test application wad 26
name: server, vd: 0, ip: 0.0.0.0 ref: 4 type:auto
    traffic:
         client:  LAN in:55124, LAN out:316649, WAN in:215482, WAN out:16000
         gateway: LAN in:0, LAN out:0, WAN in:0, WAN out:0
         client 0x2a986a6078, server 0x2a986a6098
 
total peers: 1, manual peers: 0 auto peers: 1
FGTServer # diagnose test application wad 26
name: client, vd: 0, ip: 0.0.0.0 ref: 4 type:auto
    traffic:
         client:  LAN in:0, LAN out:0, WAN in:0, WAN out:0
         gateway: LAN in:321405, LAN out:55124, WAN in:16000, WAN out:221494
         client 0x2a98aa7078, server 0x2a98aa7098
 
total peers: 1, manual peers: 0 auto peers: 1

Bring down Primary IPSEC tunnel, verify routing table and WAN optimization

•  Routing table :

FGTClient # get router info routing-table database
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       > - selected route, * - FIB route, p - stale info
S    *> 0.0.0.0/0 [10/0] via 172.31.19.254, wan1
S    *> 10.112.0.0/22 [20/0] is directly connected, Secondary-p1
S       10.112.0.0/22 [10/0] is directly connected, Primary-p1 inactive
C    *> 10.156.0.0/22 is directly connected, lan
C    *> 50.10.10.0/24 is directly connected, dmz
C    *> 172.31.16.0/22 is directly connected, wan1

FGTServer # get router info routing-table database
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       > - selected route, * - FIB route, p - stale info
S    *> 0.0.0.0/0 [10/0] via 172.31.19.254, port1
C    *> 10.112.0.0/22 is directly connected, port5
S    *> 10.156.0.0/22 [20/0] is directly connected, Secondary-p1
S       10.156.0.0/22 [10/0] is directly connected, Primary-p1 inactive
C    *> 172.31.16.0/22 is directly connected, port1
C    *> 172.31.192.0/22 is directly connected, port3

•  WAN Optimization (GUI interface is available under the version 5.0):
nvisentin_FD36592_tn_FD36592-3.jpg
GUI interface WAN Optimization

FGTClient # diagnose test application wad 26
name: server, vd: 0, ip: 0.0.0.0 ref: 7 type:auto
    traffic:
         client:  LAN in:76762, LAN out:622216, WAN in:518994, WAN out:25152
         gateway: LAN in:0, LAN out:0, WAN in:0, WAN out:0
         client 0x2a986a6078, server 0x2a986a6098
 
total peers: 1, manual peers: 0 auto peers: 1
 
FGTServer # diagnose test application wad 26
name: client, vd: 0, ip: 0.0.0.0 ref: 7 type:auto
    traffic:
         client:  LAN in:0, LAN out:0, WAN in:0, WAN out:0
         gateway: LAN in:620824, LAN out:76762, WAN in:25152, WAN out:518022
         client 0x2a98aa7078, server 0x2a98aa7098
 
total peers: 1, manual peers: 0 auto peers: 1

Troubleshooting commands

Use the WAD command:

diagnose test application wad  <test level>

Example :
23: display all protocols stats
24: flush all protocols stats
26: display all peers
99 : restart WAD

Session diagnostics :
diagnose wad session list

Protocol statistics :
diagnose wad stats list

Tunnel diagnostics :
diagnose wad tunnel list


Related Articles

Case study : FortiGate WAN Optimization over IPSec and content inspection in multiple VDOMs

Technical Note : OSPF route redundancy over 2 VPN IPSec tunnels

2773
0 Kudos
Submit Article Idea
Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Social Media
Security Research
Company
News & Articles
Contact Us

Copyright 2024 Fortinet, Inc. All Rights Reserved.