Enhanced Link Selection Route Based IPSEC VPN

[hugothebas]

Hello, friends.

I'm trying to set up a Route-Based IPsec VPN between Check Point and FortiGate using Enhanced Link Selection and BGP.

Both sides have 2 ISPs. On the Check Point side, I've configured Enhanced Link Selection as Active/Active and added both peer IPs to the Interoperable Device -> Topology.

Community Settings

Check Point Enhanced Link Selection

3rd Party Enhanced Link Selection

Interoperable Device Topology

The issue is that this setup only provides one VTI. While Check Point seems to "float" this VTI between the two ISPs, FortiGate requires a dedicated VTI (Phase 1) for each tunnel to work properly with BGP.

I found a similar discussion here (IPsec Enhanced Mode tunnel redundancy), but it focuses on Domain-Based VPN. I’ve already tested Domain-Based, but the failover is too slow (over a minute) and unreliable for our needs.

I previously tried the "old school" method of creating two separate Interoperable Devices, but it was unstable and seems to defeat the purpose of Enhanced Link Selection.

Is there a way to achieve fast BGP convergence using VTIs while still leveraging Enhanced Link Selection, or am I hitting a limitation of how CP interacts with 3rd-party VTIs?

Thanks in advance.

[the_rock]

I would put empty group vpn domain in interoperable object setting, rather than all IPs.

[hugothebas]

Thanks for the answer, Andy.

I think community settings overrides that configuration, doesn't it?

[the_rock]

Not 100% sure, but if you are able to manually edit it, you can try that.

[hugothebas]

I surely can do it, but this wouldn't solve the VTI issue, maybe it could improve domain based setup, I definitely can try that if BGP is really not possible, I just want to be sure. 

[the_rock]

I personally always found BGP works better in this case when using unnumbered VTIs.

[hugothebas]

It doesn't matter if I use numbered or unnumbered VTi, since I need to to define the peer name to match the Interoperable Device Object, I cannot create more than one VTI, unless it's possible to create 2 VTIs matching the same Interoperable device, never tried that, and even if it's possible hw would the gateway know which VTI matches each peer?

[the_rock]

I dont believe you can do that, but will try later.

[the_rock]

@hugothebas 

As I suspected, not possible if you use same peer name.

 

[hugothebas]

Then I probably hit a limitation. Does it worth opening a TAC case? Maybe they can update the documentation and insert this limitation (if confirmed).

[the_rock]

I would do that, yes.