topic Re: IPSEC VSX load balance in Firewall and Security Management

IPSEC VSX load balance

victor_cortez — Mon, 06 Nov 2023 22:55:48 GMT

Hello guys,

Here is my scneario, r81 Vsystem:

I have a vpn community IPSEC from my peer Ckp-Vs-SG to 2 different fgt peers, Fgt-A and Fgt-B.

MEP Manually:

Fgt-A is the primay under MEP

Fgt-B is the secondary under MEP

So now I want to send traffic to both Fgt-A and B and balance. How to set this on CKP side?

Route based it is not supported on vsx, right?

The final result is active/active VPN balancing traffic between the Fortigate side.

Tks,

Victor C

Wolfgang — Mon, 06 Nov 2023 20:42:31 GMT

More detailed description would be helpful.

I understand Fgt as Fortigate at the remote site. This requires the use of DPD (DeadPeerDetection) with third party VPN gateways. Follow VPN redundancy does not work when establishing an IPsec VPN Tunnel with a third-party peer to configure.

victor_cortez — Mon, 06 Nov 2023 22:56:47 GMT

I want active/active balancing traffic through both Fortigates A and B.

Chris_Atkinson — Mon, 06 Nov 2023 23:46:03 GMT

Route based (VTI) is supported on VSX with dynamic routing (BGP) in R81.x

Wolfgang — Tue, 07 Nov 2023 14:07:17 GMT

I believe load balancing is not possible with third party.