IPsec VPN load balancing

FortiGate-7000E IPsec load balancing is tunnel based. You can set the load balance strategy for each tunnel when configuring phase1-interface options:

config vpn ipsec phase1-interface

edit <name>

set ipsec-tunnel-slot {master | auto | FPM3 | ... | FPMX}

end

master all tunnels started by this phase 1 terminate on the primary FPM.

auto the default setting. All tunnels started by this phase 1 are load balanced to an FPM slot based on the src-ip and dst-ip hash result. All traffic for a given tunnel instance is processed by the same FPM.

FPM3 to FPMX all tunnels started by this phase 1 terminate on the selected FPM. The number of FPM slots depends on the number of active FPM in the FortiGate-7000E.

Even if you select master or a specific FPM, new SAs created by this tunnel are synchronized to all FPMs.

If the IPsec interface includes dynamic routing, the ipsec-tunnel-slot option is ignored and all tunnels are terminated on the primary FPM.