Configure the VPN peers – route-based VPN
VPN peers are configured using Interface Mode for redundant tunnels. Configure each VPN peer as follows:
1. Ensure that the interfaces used in the VPN have static IP addresses.
2. Create a Phase 1 configuration for each of the paths between the peers.
3. Enable dead peer detection so that one of the other paths is activated if this path fails.
4. Enter these settings in particular, and any other VPN settings as required:
Path 1
Remote Gateway Select Static IP Address.
IP Address Type the IP address of the primary interface of the remote peer.
Local Interface Select the primary public interface of this peer.
Dead Peer Detection Enable
Path 2
Remote Gateway Select Static IP Address.
IP Address Type the IP address of the secondary interface of the remote peer.
Local Interface Select the primary public interface of this peer.
Dead Peer Detection Enable
Path 3
Remote Gateway Select Static IP Address.
IP Address Type the IP address of the primary interface of the remote peer.
Local Interface Select the secondary public interface of this peer.
Dead Peer Detection Enable
Path 4
Remote Gateway Select Static IP Address.
IP Address Type the IP address of the secondary interface of the remote peer.
Local Interface Select the secondary public interface of this peer.
Dead Peer Detection Enable
For more information, see Phase 1 parameters on page 1624.
5. Create a Phase 2 definition for each path. See Phase 2 parameters on page 1642. Select the Phase 1 configuration (virtual IPsec interface) that you defined for this path. You can select the name from the Static IP Address part of the list.
6. Create a route for each path to the other peer. If there are two ports on each peer, there are four possible paths between the peer devices.
Destination IP/Mask The IP address and netmask of the private network behind the remote peer.
Device One of the virtual IPsec interfaces on the local peer.
Distance For each path, enter a different value to prioritize the paths.
7. Define the security policy for the local primary interface. See Defining VPN security policies on page 1648. You need to create two policies for each path to enable communication in both directions. Enter these settings in particular:
Incoming Interface Select the local interface to the internal (private) network.
Source Address All
Outgoing Interface Select one of the virtual IPsec interfaces you created in Step 2.
Destination Address All
Schedule Always
Service Any
Action ACCEPT
8. Select Create New, leave the Policy Type as Firewall and leave the Policy Subtype as Address, and enter these settings:
Incoming Interface Select one of the virtual IPsec interfaces you created in Step 2.
Source Address All
Outgoing Interface Select the local interface to the internal (private) network.
Destination Address All
Schedule Always
Service Any
Action ACCEPT
9. Place the policy in the policy list above any other policies having similar source and destination addresses.
10. Repeat this procedure at the remote FortiGate unit.