FortiGate IPsec ADVPN with SDWAN and Dual ISPs

This tutorial teaches how to configure Auto-Discovery IPsec VPN with SDWAN where each location has two ISP connections.

Contents of this video
00:00 Introduction
On the Hub
00:57 Configure SDWAN Zone
02:10 Customize VPN Tunnels
03:16 Configure Firewall Policies
04:17 Configure VPN Tunnel IP Address
05:02 Configure iBGP
On Spoke 1
06:31 Configure SDWAN Zone
07:45 Customize VPN Tunnels
08:30 Configure Firewall Policies
09:28 Configure VPN Tunnel IP Address
On Spoke 2
10:15 Configure SDWAN Zone
11:15 Customize VPN Tunnels
11:55 Configure Firewall Policies
12:40 Configure VPN Tunnel IP Address
On Spoke 1
13:19 Configure iBGP
On Spoke 2
14:35 Configure iBGP
On Hub
15:58 Configure SDWAN Performance SLAs
17:28 Configure SDWAN Rules
On Spoke 1
18:30 Configure SDWAN Performance SLAs
19:45 Configure SDWAN Rules
On Spoke 2
20:47 Configure SDWAN Performance SLAs
21:48 Configure SDWAN Rules
On Hub and Spokes
23:00 Enable ECMP

If you have any questions or need further assistance, please feel free to leave a comment below. Don’t forget to subscribe to our channel for more helpful tutorials.

[jonluigimalihan]

this is great! hope there will also a tutorial on how to setup a dual hub since it has a point of failure when hub FW goes down

[danielweaver]

Awesome video, thank you so much for taking the time to put this together!!

[taukirsyed]

Thanks for the efforts to build this video. Helped me heaps!

[praneethbashitha]

This is a superb video. Please share the config backup if possible.

[msh]

This was quite informative Sir..Thank you!

[cdfaulk]

This is the best tutorial ever BUT you don’t address the issue of asymmetric routing that is reverse path check failed, deny. How do you take care of that. I have done six of these implementations & in each case I had to deploy a method to prevent asymmetric routing. If you know a simpler way to do it, I would love to learn that.

[hummer-kk]

Thank you so much! 🙂🙂 Can you please advanced video with like "set additional-path" ... ?

[ricardosoriano]

Thank you very much for the video. Super grateful!!

[kelumidu]

This is most effective and valuable one thank you

[isknnop]

Thanks for the video. Its very informative. I tried in my lab and I could use only one path between the spokes and second path does not come up though both tunnels are up. Could you please suggest?

[TheKinhoow]

I noticed something, on my Spokes, the HUB network does not appear to be advertised in BGP, but I can ping it and the Firewall is forwarding it to the tunnel, is that the case or did I do something wrong?

[kelumidu]

One small request the ad vpn is involve lot of spokes therefore it easy to manage via fortimanager. if you think more lessons i suggest same setup doing with fortimanager as well

[jowhor]

Thanks for the great work. Can you please tell us how you setup the gateways for both WAN links? Are you used Static Routing? Adding those information may helpful for everyone.

Thanks again.

[shahbazsandhu]

Thank you for sharing this fantastic video. Furthermore, I just have the following question:

1) Why did you change the load-balancing mode to Weight base, and did you make any changes to the WAN links' sides at the same time?
2) Additionally, you set the ecmp-max-paths to 4. Could you kindly clarify why this was the case, and what the value would be if there were additional spoke sites, such as 4 or 5 ?

[VishnuK-bree]

I have mesh topology. I'm migrating from Paloalto to FortiGate. I need to create two tunnels to AWS/remote sites for redundancy along with BGP. How to give priority to one specific tunnel on BGP ? Can somebody help me I struck since I'm new to FortiGate.

[josemauricioporrastarazona]

Muchas gracias por la información fue muy útil y funcional. Excelente video.

[prem]

Spoke to spoke cross tunnel communication is not happening

[ChampionCCC]

I have tried on Live kit, but I have problems. Is something necessary to enable the Overlay Routing Protocol ? My VPN is UP, I can ping the VPN Interface IP at each end, but not across the VPN, and when I do "get router info bgp summary", it is completely blank

[mooreVids]

Following your example in this video, when changing the VPN to custom and selecting dialup, it will not allow it to be created for me. I get a -9999:-9999 error every time. What OS version are you running in your example? I'm using 7.2.5 and it will not work. Any ideas?

[trionotriono]

What are the advantages of this system sir? Because I am currently only using aggregate tunnels for the three sites as shown in the diagram.