Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

FortiGate-6000 Handbook

SD-WAN with multiple IPsec VPN tunnels

To support SD-WAN with IPsec VPN, the IPsec VPN tunnel configuration of all IPsec VPN tunnels that are members of the same SD-WAN zone in the same VDOM must send traffic to the same FPC. This means the ipsec-tunnel-slot configuration of the IPsec VPN tunnel must include a specific FPC. Setting ipsec-tunnel-slot to master is not recommended, since the primary FPC can change. Setting ipsec-tunnel-slot to auto is not supported.

Please note the following limitations for this feature:

  • Auto negotiation must be enabled in the IPsec VPN phase 2 configuration for all IPsec tunnels added to an SD-WAN zone.

  • An SD-WAN zone can include a mixture of IPsec VPN interfaces and other interface types (for example, physical interfaces). If an SD-WAN zone contains an IPsec VPN interface, all traffic accepted by interfaces in that SD-WAN zone is sent to the same FPC, including traffic accepted by other interface types.

  • SD-WAN health checking is not supported for IPsec VPN SD-WAN members.

  • SD- WAN traffic information, including packet statistics, policy hit counts, and so on is not supported for IPsec VPN SD-WAN members.

SD-WAN with multiple IPsec VPN tunnels

To support SD-WAN with IPsec VPN, the IPsec VPN tunnel configuration of all IPsec VPN tunnels that are members of the same SD-WAN zone in the same VDOM must send traffic to the same FPC. This means the ipsec-tunnel-slot configuration of the IPsec VPN tunnel must include a specific FPC. Setting ipsec-tunnel-slot to master is not recommended, since the primary FPC can change. Setting ipsec-tunnel-slot to auto is not supported.

Please note the following limitations for this feature:

  • Auto negotiation must be enabled in the IPsec VPN phase 2 configuration for all IPsec tunnels added to an SD-WAN zone.

  • An SD-WAN zone can include a mixture of IPsec VPN interfaces and other interface types (for example, physical interfaces). If an SD-WAN zone contains an IPsec VPN interface, all traffic accepted by interfaces in that SD-WAN zone is sent to the same FPC, including traffic accepted by other interface types.

  • SD-WAN health checking is not supported for IPsec VPN SD-WAN members.

  • SD- WAN traffic information, including packet statistics, policy hit counts, and so on is not supported for IPsec VPN SD-WAN members.