Technical Tip: Setting up IPsec VPN Failover for Internet Access in FortiGate

[pcavalcante]

Description	This article describes the process of configuring an IPsec VPN as a failover route to maintain uninterrupted internet access in the event of a primary ISP connection failure. The scenario involves two sites, Site1 and Site2, where the primary objective is to establish an IPsec VPN tunnel through Site2 to ensure continuous connectivity for critical operations, even during network interruptions.
Scope	Imagine a scenario where there are two sites, Site1 and Site2. To ensure continuous internet access at Site1, it is wanted to establish an IPsec VPN tunnel as a failover route through Site2 in case Site1's primary ISP link goes down. This configuration helps maintain seamless connectivity even in the face of network interruptions.
Solution	Step 1: Configure a Dummy Network Between the Peers (Performed on Both Sites). Begin by creating a dummy network between Site1 and Site2. This is a fundamental step for routing internet traffic through the IPsec tunnel. On Site1: Navigate to Network -> Interfaces. Edit the PORT used for the IPsec interface. Set a dummy network IP Address, such as 10.0.0.1/32.   On Site2: Perform identical steps as Site1 but assign the IP Address as 10.0.0.2/32. Step 2: Adjust IPsec Configuration (Perform on Both Sites). Update the IPsec Phase 2 selectors to permit all traffic through the IPsec tunnel. Modify the Local and Remote Addresses to 0.0.0.0/0.0.0.0. Step 3: Configure SD-WAN (Perform on Site1). Create an SD-WAN Zone including the WAN and IPsec interfaces: Create an SD-WAN zone to encompass both the WAN and IPsec interfaces. This is essential for traffic management and failover. Go to Network -> SD-WAN. Select Create New -> SD-WAN Member. Select the WAN interface. Select OK. Create another member for the IPsec interface following the same steps. Step 4: Create 2 SD-WAN Rules (Perform on Site1). Establish two SD-WAN rules to effectively manage traffic. Rule 1 - IPsec Traffic: This rule directs IPsec traffic appropriately. Navigate to Network -> SD-WAN. Select SD-WAN Rules. Select Create New. Add the Local Subnet object as the Source Address. Add the Destination Subnet object as the Destination Address. Choose Manual for Outgoing interfaces. Add the IPsec interface to Interface Preferences. Select OK.   Rule 2 - Default Traffic: This rule manages all other traffic. Navigate to Network -> SD-WAN. Select SD-WAN Rules. Select Create New. Add the 'all' object as the Source Address. Add the 'all' object as the Destination Address. Choose Manual for Outgoing interfaces. Add the WAN interface and then the IPsec interface (in this order) to Interface Preferences. Select OK. Step 5: Setup Performance SLAs to Enable Traffic Failover.