Packet distribution and redundancy for aggregate IPsec tunnels

This is a sample configuration of a multiple site-to-site IPsec VPN that uses an IPsec aggregate interface to set up redundancy and traffic load-balancing. The VPN tunnel interfaces must have net-device disabled in order to be members of the IPsec aggregate.

Each FortiGate has two WAN interfaces connected to different ISPs. OSPF runs over the IPsec aggregate in this configuration.

The supported load balancing algorithms are: L3, L4, round-robin (default), weighted round-robin, and redundant. The first four options allow traffic to be load-balanced, while the last option (redundant) uses the first tunnel that is up for all traffic.

Dynamic routing can run on the aggregate interface, and it can be a member interface in SD-WAN (not shown in this configuration).

Configuring the HQ1 FortiGate in the GUI

There are five steps to configure the FortiGate:

1. Create the IPsec tunnels.

2. Create the IPsec aggregate.

3. Configure the firewall policies.

4. Configure the aggregate VPN interface IPs.

5. Configure OSPF.

To create the IPsec tunnels:

1. Go to VPN > IPsec Wizard and select the Custom template.

2. For Name, enter pri_HQ2 and click Next.

3. Enter the following:

   Phase 1
   IP Address	172.16.202.1
   Interface	port1
   Device creation	Disabled
   Aggregate member	Enabled
   Authentication Method	Pre-shared Key
   Pre-shared Key	Enter the secure key
   IKE Mode	Aggressive
   Peer Options Accept Types	Any peer ID
   Phase 2
   Auto-negotiate	Enable

4. Configure the other settings as needed.

5. Click OK.

6. Create another tunnel named sec_HQ2 with the following settings:

   Phase 1
   IP Address	172.17.202.1
   Interface	port2
   Device creation	Disabled
   Aggregate member	Enabled
   Authentication Method	Pre-shared Key
   Pre-shared Key	Enter the secure key
   IKE Mode	Aggressive
   Peer Options Accept Types	Any peer ID
   Phase 2
   Auto-negotiate	Enable

To create the IPsec aggregate:

1. Go to VPN > IPsec Tunnels and click Create New > IPsec Aggregate.

2. For Name, enter agg_HQ2.

3. Select a load balancing algorithm.

4. From the Tunnel dropdown, select the tunnels that you created previously (pri_HQ2 and sec_HQ2). If required, enter weights for each tunnel.

5. Click OK.

To configure the firewall policies:

1. Go to Policy & Objects > Firewall Policy.

2. Create an inbound traffic policy with the following settings:

   Name	inbound
   Incoming Interface	agg_HQ2
   Outgoing Interface	dmz
   Source	172.16.101.0
   Destination	10.1.100.0
   Schedule	always
   Action	ACCEPT
   Service	ALL

3. Click OK.

4. Create an outbound traffic policy with the following settings:

   Name	outbound
   Incoming Interface	dmz
   Outgoing Interface	agg_HQ2
   Source	10.1.100.0
   Destination	172.16.101.0
   Schedule	always
   Action	ACCEPT
   Service	ALL

To configure the aggregate VPN interface IPs:

1. Go to Network > Interfaces and edit agg_HQ2.

2. For IP, enter 10.10.10.1.

3. For Remote IP/Netmask, enter 10.10.10.2 255.255.255.255.

4. Click OK.

To configure OSPF:

1. Go to Network > OSPF.

2. For Router ID, enter 1.1.1.1.

3. In the Areas table, click Create New.

   1. For Area ID, enter 0.0.0.0.

   2. Click OK.

4. In the Networks table, click Create New.

   1. Set the Area to 0.0.0.0.

   2. For IP/Netmask, enter 10.1.100.0/24.

   3. Click OK.

   4. Click Create New.

   5. For IP/Netmask, enter 10.10.10.0/24.

   6. Click OK.

5. Click Apply.

Configuring the HQ2 FortiGate in the GUI

There are five steps to configure the FortiGate:

1. Create the IPsec tunnels.

2. Create the IPsec aggregate.

3. Configure the firewall policies.

4. Configure the aggregate VPN interface IPs.

5. Configure OSPF.

To create the IPsec tunnels:

1. Go to VPN > IPsec Wizard and select the Custom template.

2. For Name, enter pri_HQ1 and click Next.

3. Enter the following:

   Phase 1
   IP Address	172.16.200.1
   Interface	port25
   Device creation	Disabled
   Aggregate member	Enabled
   Authentication Method	Pre-shared Key
   Pre-shared Key	Enter the secure key
   IKE Mode	Aggressive
   Peer Options Accept Types	Any peer ID
   Phase 2
   Auto-negotiate	Enable

4. Configure the other settings as needed.

5. Click OK.

6. Create another tunnel named sec_HQ1 with the following settings:

   Phase 1
   IP Address	172.17.200.1
   Interface	port26
   Device creation	Disabled
   Aggregate member	Enabled
   Authentication Method	Pre-shared Key
   Pre-shared Key	Enter the secure key
   IKE Mode	Aggressive
   Peer Options Accept Types	Any peer ID
   Phase 2
   Auto-negotiate	Enable

To create the IPsec aggregate:

1. Go to VPN > IPsec Tunnels and click Create New > IPsec Aggregate.

2. For Name, enter agg_HQ1.

3. Select a load balancing algorithm.

4. From the Tunnel dropdown, select the tunnels that you created previously (pri_HQ1 and sec_HQ1). If required, enter weights for each tunnel.

5. Click OK.

To configure the firewall policies:

1. Go to Policy & Objects > Firewall Policy.

2. Create an inbound traffic policy with the following settings:

   Name	inbound
   Incoming Interface	agg_HQ1
   Outgoing Interface	port9
   Source	10.1.100.0
   Destination	172.16.101.0
   Schedule	always
   Action	ACCEPT
   Service	ALL

3. Click OK.

4. Create an outbound traffic policy with the following settings:

   Name	outbound
   Incoming Interface	port9
   Outgoing Interface	agg_HQ1
   Source	172.16.101.0
   Destination	10.1.100.0
   Schedule	always
   Action	ACCEPT
   Service	ALL

To configure the aggregate VPN interface IPs:

1. Go to Network > Interfaces and edit agg_HQ1.

2. For IP, enter 10.10.10.2.

3. For Remote IP/Netmask, enter 10.10.10.1 255.255.255.255.

4. Click OK.

To configure OSPF:

1. Go to Network > OSPF.

2. For Router ID, enter 2.2.2.2.

3. In the Areas table, click Create New.

   1. For Area ID, enter 0.0.0.0.

   2. Click OK.

4. In the Networks table, click Create New.

   1. Set the Area to 0.0.0.0.

   2. For IP/Netmask, enter 172.16.101.0/24.

   3. Click OK.

   4. Click Create New.

   5. For IP/Netmask, enter 10.10.10.0/24.

   6. Click OK.

5. Click Apply.

Monitoring the traffic in the GUI

To monitor the traffic:

1. Go to Dashboard > Network , hover over the IPsec widget, then click Expand to Full Screen.

2. Expand the aggregate tunnel in the table to view statistics for each aggregate member.

Configuring the HQ1 FortiGate in the CLI

There are six steps to configure the FortiGate:

1. Configure the interfaces.

2. Configure two IPsec phase 1 and phase 2 interfaces.

3. Configure the IPsec aggregate.

4. Configure the firewall policies.

5. Configure the aggregate VPN interface IPs.

6. Configure OSPF.

To configure the interfaces:

1. Configure port1, port2, and dmz as shown in the topology diagram.

To configure two IPsec phase 1 and phase 2 interfaces:

config vpn ipsec phase1-interface
    edit "pri_HQ2"
        set interface "port1"
        set peertype any
        set net-device disable
        set aggregate-member enable
        set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
        set remote-gw 172.16.202.1
        set psksecret sample1
    next
    edit "sec_HQ2"
        set interface "port2"
        set peertype any
        set net-device disable
        set aggregate-member enable
        set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
        set remote-gw 172.17.202.1
        set psksecret sample2
    next   
end  
config vpn ipsec phase2-interface
    edit "pri_HQ2"
        set phase1name "pri_HQ2"
        set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
        set auto-negotiate enable
    next
    edit "sec_HQ2"
        set phase1name "sec_HQ2"
        set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
        set auto-negotiate enable
    next   
end

To configure the IPsec aggregate:

config system ipsec-aggregate
    edit "agg_HQ2"
        set member "pri_HQ2" "sec_HQ2"
    next
end

To configure the firewall policies:

config firewall policy
    edit 1
        set name "inbound"
        set srcintf "agg_HQ2"
        set dstintf "dmz"
        set srcaddr "172.16.101.0"
        set dstaddr "10.1.100.0"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 2
        set name "outbound"
        set srcintf "dmz"
        set dstintf "agg_HQ2"
        set srcaddr "10.1.100.0"
        set dstaddr "172.16.101.0"
        set action accept
        set schedule "always"
        set service "ALL"
    next  
end

To configure the aggregate VPN interface IPs:

config system interface
    edit "agg_HQ2"
        set ip 10.10.10.1 255.255.255.255
        set remote-ip 10.10.10.2 255.255.255.255
    next   
end

To configure OSPF:

config router ospf
    set router-id 1.1.1.1
    config area
        edit 0.0.0.0
        next
    end
    config network
        edit 1
            set prefix 10.1.100.0 255.255.255.0
        next
        edit 2
            set prefix 10.10.10.0 255.255.255.0
        next
    end
end

Configuring the HQ2 FortiGate in the CLI

There are six steps to configure the FortiGate:

1. Configure the interfaces.

2. Configure two IPsec phase 1 and phase 2 interfaces.

3. Configure the IPsec aggregate.

4. Configure the firewall policies.

5. Configure the aggregate VPN interface IPs.

6. Configure OSPF.

To configure the interfaces:

1. Configure port25, port26, and port9 as shown in the topology diagram.

To configure two IPsec phase 1 and phase 2 interfaces:

config vpn ipsec phase1-interface
    edit "pri_HQ1"
        set interface "port25"
        set peertype any
        set net-device disable
        set aggregate-member enable
        set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
        set remote-gw 172.16.200.1
        set psksecret sample1
    next
    edit "sec_HQ1"
        set interface "port26"
        set peertype any
        set net-device disable
        set aggregate-member enable
        set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
        set remote-gw 172.17.200.1
        set psksecret sample2
    next 
end
config vpn ipsec phase2-interface
    edit "pri_HQ1"
        set phase1name "pri_HQ1"
        set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
        set auto-negotiate enable
    next
    edit "sec_HQ1"
        set phase1name "sec_HQ1"
        set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305
        set auto-negotiate enable
    next   
end

To configure the IPsec aggregate:

config system ipsec-aggregate
    edit "agg_HQ1"
        set member "pri_HQ1" "sec_HQ1"
    next
end 

To configure the firewall policies:

config firewall policy
    edit 1
        set name "inbound"
        set srcintf "agg_HQ1"
        set dstintf "port9"
        set srcaddr "10.1.100.0"
        set dstaddr "172.16.101.0"
        set action accept
        set schedule "always"
        set service "ALL"
    next
    edit 2
        set name "outbound"
        set srcintf "port9"
        set dstintf "agg_HQ1"
        set srcaddr "172.16.101.0"
        set dstaddr "10.1.100.0"
        set action accept
        set schedule "always"
        set service "ALL"
    next  
end

To configure the aggregate VPN interface IPs:

config system interface
    edit "agg_HQ1"
        set ip 10.10.10.2 255.255.255.255
        set remote-ip 10.10.10.1 255.255.255.255
    next
end

To configure OSPF:

config router ospf
    set router-id 2.2.2.2
    config area
        edit 0.0.0.0
        next
    end
    config network
        edit 1
            set prefix 172.16.101.0 255.255.255.0
        next
        edit 2
            set prefix 10.10.10.0 255.255.255.0
        next
    end
end

Monitoring the traffic in the CLI

To view debugging information:

1. Verify the status of the phase 1 IKE SAs:

   # diagnose vpn ike gateway list
   vd: root/0
   name: pri_HQ2
   version: 1
   interface: port1 11
   addr: 172.16.200.1:500 -> 172.16.202.1:500
    tun_id: 172.16.202.1
   created: 1520s ago
   IKE SA: created 1/2 established 1/1 time 10/10/10 ms
   IPsec SA: created 2/2 established 1/1 time 0/0/0 ms
       id/spi: 173 dcdede154681579b/e32f4c48c4349fc0 direction: responder status: established 1498-1498s ago = 10ms proposal: aes128-sha256 key: d7230a68d7b83def-588b94495cfa9d38 lifetime/rekey: 86400/84631 DPD sent/recv: 0000000d/00000006
   vd: root/0
   name: sec_HQ2
   version: 1
   interface: port2 12
   addr: 172.17.200.1:500 -> 172.17.202.1:500
   created: 1520s ago
   IKE SA: created 1/2 established 1/1 time 10/10/10 ms
   IPsec SA: created 2/2 established 1/1 time 0/0/0 ms
       id/spi: 174 a567bd7bf02a04b5/4251b6254660aee2 direction: responder status: established 1498-1498s ago = 10ms proposal: aes128-sha256 key: 9f44f500c28d8de6-febaae9d1e6a164c lifetime/rekey: 86400/84631 DPD sent/recv: 00000008/0000000c

2. Verify the phase 2 IPsec tunnel SAs:

   # diagnose vpn tunnel list
   list all ipsec tunnel in vd 0
   name=sec_HQ2 ver=1 serial=2 172.17.200.1:0->172.17.202.1:0 tun_id=172.17.202.1
   bound_if=5 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/512 options[0200]=frag-rfc run_state=1 accept_traffic=1
   proxyid_num=1 child_num=0 refcnt=7 ilast=5 olast=5 ad=/0
   stat: rxp=39 txp=40 rxb=5448 txb=2732
   dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=15
   natt: mode=none draft=0 interval=0 remote_port=0
   proxyid=sec_HQ2 proto=0 sa=1 ref=2 serial=2 auto-negotiate
       src: 0:0.0.0.0/0.0.0.0:0 dst: 0:0.0.0.0/0.0.0.0:0 SA: ref=3 options=18227 type=00 soft=0 mtu=1438 expire=41230/0B replaywin=2048
           seqno=29 esn=0 replaywin_lastseq=00000028 itn=0
       life: type=01 bytes=0/0 timeout=42899/43200 dec: spi=1071b4f9 esp=aes key=16 1f4dbb78bea8e97650b52d8170b5ece7
           ah=sha1 key=20 cd9bf2de0f49296cf489dd915d7baf6d78bc8f12
       enc: spi=ec89b7ee esp=aes key=16 0546efecd0d1b9ba5944f635896e4404
           ah=sha1 key=20 34599bc7dc25e1ce63ac9615bd50928ce0667dc8
       dec:pkts/bytes=39/2796, enc:pkts/bytes=40/5456
   name=pri_HQ2 ver=1 serial=1 172.16.200.1:0->172.16.202.1:0 tun_id=172.16.202.1
   bound_if=11 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/512 options[0200]=frag-rfc run_state=1 accept_traffic=1
   proxyid_num=1 child_num=0 refcnt=5 ilast=15 olast=15 ad=/0
   stat: rxp=38 txp=39 rxb=5152 txb=2768
   dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=20
   natt: mode=none draft=0 interval=0 remote_port=0
   proxyid=pri_HQ2 proto=0 sa=1 ref=2 serial=2 auto-negotiate
       src: 0:0.0.0.0/0.0.0.0:0 dst: 0:0.0.0.0/0.0.0.0:0 SA: ref=3 options=18227 type=00 soft=0 mtu=1438 expire=41231/0B replaywin=2048
           seqno=28 esn=0 replaywin_lastseq=00000027 itn=0
       life: type=01 bytes=0/0 timeout=42900/43200 dec: spi=1071b4f8 esp=aes key=16 142cce377b3432ba41e64128ade6848c
           ah=sha1 key=20 20e64947e2397123f561584321adc0e7aa0c342d
       enc: spi=ec89b7ed esp=aes key=16 2ec13622fd60dacce3d28ebe5fe7ab14
           ah=sha1 key=20 c1787497508a87f40c73c0db0e835c70b3c3f42d
       dec:pkts/bytes=38/2568, enc:pkts/bytes=39/5432

3. Debug the IPsec aggregation list:

   # diagnose sys ipsec-aggregate list
   agg_HQ2 algo=RR member=2 run_tally=2
   members:
       pri_HQ2
       sec_HQ2

4. Verify the OSPF neighbor information:

   # get router info ospf neighbor
   OSPF process 0, VRF 0:
   Neighbor ID Pri State Dead Time Address Interface
   2.2.2.2 1. Full/ - 00:00:34 10.10.10.2 agg1_HQ2

5. Verify the OSPF routing table:

   # get router info routing-table ospf
   Routing table for VRF=0
   O 172.16.101.0/24 [110/20] via 10.10.10.2, agg1_HQ2 , 00:18:43