IPsec IKE load balancing based on FortiSASE account information

The FortiGate device ID is carried by the IKEv2 message NOTIFY payload when it is configured.

config vpn ipsec phase1-interface
    edit <name>
        set dev-id-notification enable
        set dev-id <string>
    next
end

This device ID configuration is required when the FortiGate is configured as a secure edge LAN extension for FortiSASE. It allows FortiSASE to distribute IKE/IPsec traffic according to the FortiGate device ID to achieve load balancing.

Example

In this example, a FortiGate SD-WAN is configured, which acts as a secure edge. FortiSASE ensures secure internet access for users in the local network behind the FortiGate and allows other FortiSASE remote users with secure private access to private resources behind the FortiGate.

To configure FortiGate A (FGT-A):

1. Configure the IPsec phase 1 settings:

   config vpn ipsec phase1-interface
       edit "ul-port1"
           set interface "port1"
           set ike-version 2
           set peertype any
           set net-device disable
           set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
           set localid "peerid-UNshTWcLQ22UNWqk0UwYtCQNtVhujrxAdyMG0qRsGVkx9mM8ksdaRZOF"
           set dpd on-idle
           set comments "[FGCONN] Do NOT edit. Automatically generated by extension controller."
           set dev-id-notification enable
           set dev-id "FGT_A"
           set remote-gw 172.16.200.2
           set psksecret ********
       next
   end

2. Verify that the IPsec tunnel is established:

   # diagnose vpn tunnel list
   list all ipsec tunnel in vd 3
   ------------------------------------------------------
   name=ul-port1 ver=2 serial=3 172.16.200.1:0->172.16.200.2:0 tun_id=172.16.200.2 tun_id6=::172.16.200.2 dst_mtu=1500 dpd-link=on weight=1
   bound_if=19 lgwy=static/1 tun=intf mode=auto/1 encap=none/552 options[0228]=npu frag-rfc  run_state=0 role=primary accept_traffic=1 overlay_id=0
   
   proxyid_num=1 child_num=0 refcnt=4 ilast=0 olast=0 ad=/0
   stat: rxp=2689 txp=7115 rxb=278520 txb=617095
   dpd: mode=on-idle on=1 idle=20000ms retry=3 count=0 seqno=1
   natt: mode=none draft=0 interval=0 remote_port=0
   fec: egress=0 ingress=0
   proxyid=ul-port1 proto=0 sa=1 ref=3 serial=1
     src: 0:10.252.0.2-10.252.0.2:0
     dst: 0:10.252.0.1-10.252.0.1:0
     SA:  ref=6 options=10226 type=00 soft=0 mtu=1438 expire=41281/0B replaywin=2048
          seqno=1bca esn=0 replaywin_lastseq=00000a80 qat=0 rekey=0 hash_search_len=1
     life: type=01 bytes=0/0 timeout=42897/43200
     dec: spi=acf1f0fc esp=aes key=16 97d75ba10fbc904f14ce4a4caf8b4148
          ah=sha1 key=20 4ab706602068f9590314c4b16f53130a8011f410
     enc: spi=ca8de50b esp=aes key=16 8185ec9d2ecbb1d157663a6c199fc998
          ah=sha1 key=20 9430df55054152ab88e7372a322aad8f87688614
     dec:pkts/bytes=2690/278560, enc:pkts/bytes=14227/1632503
     npu_flag=03 npu_rgwy=172.16.200.2 npu_lgwy=172.16.200.1 npu_selid=2 dec_npuid=2 enc_npuid=2
   run_tally=0

3. Perform a packet capture of IPsec traffic (Wireshark is used in this example) and locate the initiator request IKE packet's NOTIFY message (type 61699).