4）配置IPsec VPN的主备分析与配置

说明：如果要删除IPSEC VPN第一阶段、第二阶段时，需要先删除被调用的路由与防火墙安全策略。

四、配置步骤

1、配置FortiGate1 （BJ）

1) 基本上网配置

配置详细过程请参照 "路由模式典型功能--单线上网--静态地址线路上网配置"一节：

接口IP配置如下：

路由配置如下

2) 根据模板配置WAN1到FortiGate2_SH的IPsec VPN（默认即为IPSEC接口模式）

进入：虚拟专网--IPSEC隧道--"新建"

可以选择根据向导进行相应的IPsec VPN模板进行配置：

说明：如果最后完成模板部署的时候报错，那么需要注意，不要有旧的配置存在，比如相关VPN的策略、VPN的路由、VPN的IP地址对象，需要把这些内容删除干净才可以顺利的部署向导模板，一般第一次部署不会遇到报错。

3) 根据模板配置WAN2到FortiGate2_SH的IPsec VPN（默认即为IPSEC接口模式）

进入：虚拟专网--IPSEC隧道--"新建"

可以选择根据向导进行相应的IPsec VPN模板进行配置：

总部建立两条IPsec VPN，一条是WAN1到SH，另外一条是WAN2到SH，VPN的主备由FortiGate2_SH来控制和选择，总部选择被动连接（没有开启自动协商），此时还不涉及到VPN主备的配置。

特别注意DPD一定建议开启on-idle模式，否则可能出现一定特殊环境下面的假死现象。

2、配置FortiGate2 (SH)

1) 基本上网配置

配置详细过程请参照 "路由模式典型功能--单线上网--静态地址线路上网配置"一节：
接口IP配置如下：

路由配置如下:

2) 根据模板配置FortiGate2_SH到总部WAN1的IPsec VPN（默认即为IPSEC接口模式）

进入：虚拟专网--IPSEC隧道--"新建"

可以选择根据向导进行相应的IPsec VPN模板进行配置：

针对模板配置的优化建议

优化建议一：在第一阶段中开启DPD周期性检测（每隔10s检测一次Peer状态），实现快速的检测并切换VPN隧道的目的。

相关命令行：
config vpn ipsec phase1-interface
edit "VPN-TO-BJ"
set dpd on-idle
next
end

优化建议二：开启自动协商，主动让隧道UP起来，而非使用VPN业务的时候再去触发VPN的协商，这样可以减少业务的丢包，同时可快速的感知VPN隧道的状态。

config vpn ipsec phase2-interface
edit "VPN-TO-BJ"
set auto-negotiate enable
next

end

3) 根据模板配置FortiGate2_SH到总部WAN2的IPsec VPN（默认即为IPSEC接口模式）

进入：虚拟专网--IPSEC隧道--"新建"

可以选择根据向导进行相应的IPsec VPN模板进行配置：

针对模板配置的优化建议

优化建议一：在第一阶段中开启DPD周期性检测（每隔10s检测一次Peer状态），实现快速的检测并切换VPN隧道的目的。

相关命令行：

config vpn ipsec phase1-interface
edit "VPN-TO-BJ"

set dpd on-idle

next
end

优化建议二：开启自动协商，主动让隧道UP起来，而非使用VPN业务的时候再去触发VPN的协商，这样可以减少业务的丢包，同时可快速的感知VPN隧道的状态。

config vpn ipsec phase2-interface
edit "VPN-TO-BJ"

set auto-negotiate enable

end

4) 配置IPsec VPN的主备分析与配置

分析：此种的配置下，两条IPsec VPN隧道都会UP起来，并且将会起到负载均衡的效果。

总部:

分支：

上述配置即为负载均衡方式的IPsec VPN。

如果要实现主备的IPsec VPN:有以下几种办法：

思路1：要做到主备，则只需要一条隧道UP，另外一条隧道则处于监听模式，一旦检测到主VPN隧道故障，则将备份的VPN协商起来，接替主VPN的工作。

只需要在命令下添加一条命令即可实现主备VPN：

config vpn ipsec phase1-interface
edit "VPN_TO_BJ_Main"
set interface "wan1"
set peertype any
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set dpd on-idle
set comments "VPN: VPN_TO_BJ_Main (Created by VPN wizard)"
set remote-gw 100.1.1.2
set psksecret Fortinet123#
next
edit "VPN_TO_BJ_Bak"
set interface "wan1"
set peertype any
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set dpd on-idle
set comments "VPN: VPN_TO_BJ_Bak (Created by VPN wizard)"
set remote-gw 101.1.1.2
set monitor "VPN_TO_BJ_Main" --- 只需要添加这一条命令即可
set psksecret Fortinet123#
next

end

默认"VPN_TO_BJ_Bak"处于DOWN的状态，同时"VPN_TO_BJ_Bak" Monitor "VPN_TO_BJ_Main"，一旦"VPN_TO_BJ_Main"故障，则"VPN_TO_BJ_Bak"隧道会主动发起VPN协商并接替主的工作。

效果如下：

思路2：不需要配置moniter，让两条VPN都UP起来，通过调整静态路由的优先级，让FortiGate2_SH去往北京主要走VPN_TO_BJ_Main，而VPN_TO_BJ_Bak作为路由的备份，一旦主VPN故障，则隧道会DOWN，然后主VPN的路由会消失，备VPN路由UP，接替业务处理。

config router static

edit 2

set device "VPN_TO_BJ_Main"

set comment "VPN: VPN_TO_BJ_Main (Created by VPN wizard)"

set dstaddr "VPN_TO_BJ_Main_remote"

edit 4

set priority 100

set device "VPN_TO_BJ_Bak"

set comment "VPN: VPN_TO_BJ_Bak (Created by VPN wizard)"

set dstaddr "VPN_TO_BJ_Bak_remote"

end

效果如下：

FortiGate2_ShangHai # get router info routing-table all

Routing table for VRF=0
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default

S* 0.0.0.0/0 [10/0] via 200.1.1.254, wan1
S 192.168.0.0/24 [10/0] is directly connected, VPN_TO_BJ_Main
[10/0] is directly connected, VPN_TO_BJ_Bak, [100/0] 优先级低的Main会用于转发数据，而优先级为100的Bak，不转发流量，仅仅用于浮动静态路由的备份作用。
C 192.168.1.0/24 is directly connected, internal

C 200.1.1.0/24 is directly connected, wan1

思路3：不需要配置moniter，让两条VPN都UP起来，通过OSPF（动态路由协议），并调整tunnel接口Cost值，实现主备VPN的效果，道理和思路2一致，只是使用OSPF。

具体配置过程不再展示，可参考“VPN隧道上运行OSPF”章节。

思路4：不需要配置moniter，让两条VPN都UP起来，通过BGP（动态路由协议），并调整AP_PATH属性，实现主备VPN的效果，道理和思路2一致，只是使用BGP的AP_PATH属性去实现选路和备份。

FortiGate1_BeiJing BGP配置：

config router route-map

  edit "AS_PATH_ADD"

config rule

edit 1

set set-aspath "400" "300"

next

end

next

end

config router bgp

set as 100

set router-id 1.1.1.1

config neighbor

edit "1.1.1.2

set remote-as 200

  set route-map-out "AS_PATH_ADD"

next

edit "2.2.2.2"

set remote-as 200

next

end

config network

edit 1

set prefix 192.168.0.0 255.255.255.0

next

end

FortiGate2_ShangHai BGP配置：

config router route-map

  edit "AS_PATH_ADD"

config rule

edit 1

set set-aspath "400" "300"

next

end

next

end

config router bgp

set as 200

set router-id 1.1.1.2

config neighbor

edit "1.1.1.1"

set remote-as 100

  set route-map-out "AS_PATH_ADD"

next

edit "2.2.2.1"

set remote-as 100

next

end

config network

edit 1

set prefix 192.168.1.0 255.255.255.0

next

end

FortiGate1_BeiJing # get router info bgp network

BGP table version is 3, local router ID is 10.10.10.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight RouteTag Path

*> 192.168.0.0 0.0.0.0    100 32768 0 i <-/1>

*> 192.168.1.0 2.2.2.2    0    0 0 200 i <-/1> ---选择AS_PATH短的，因此路由优选走2.2.2.2

* 1.1.1.2    0    0 0 200 400 300 i <-/-> ---备份路由

Total number of prefixes 2

FortiGate2_ShangHai # get router info bgp network

BGP table version is 4, local router ID is 10.10.10.2

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight RouteTag Path

*> 192.168.0.0 2.2.2.1    0    0 0 100 i   ---选择AS_PATH短的，因此路由优选走2.2.2.1

* 1.1.1.1    0    0 0 100 400 300 i ---备份路由

*> 192.168.1.0 0.0.0.0    100 32768 0 i

Total number of prefixes 2

说明：以上讨论仅仅适用于总部和分支都是静态固定IP的厂家，都是LAN-TO-LAN的静态VPN场景。如果总部是动态VPN的场景，则思路2、思路3和思路4在默认配置的情况下是行不通的，需要调整一些配置才可以，难度相对较大，因此思路1的解决方法更加具有通用性，同时适用于静态VPN场景和动态VPN场景的主备VPN。

五、检查配置结果

仅仅针对思路1的VPN主备切换测试：

正常情况下：

手动把主VPN DOWN掉：

Ping切换过程：

切换后VPN和路由状态：

切换过程中的抓包情况（丢包4秒，VPN主备的切换过程中流量匹配到黑洞路由，数据包丢弃，直到切换到备份VPN上，整个流量切换大约5秒左右）：

FortiGate2_ShangHai # diagnose sniffer packet any "host 192.168.0.111 and icmp" 4 0 a

interfaces=[any]
filters=[host 192.168.0.111 and icmp]
2019-03-28 05:21:42.988626 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:42.988788 VPN_TO_BJ_Main out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:42.989904 VPN_TO_BJ_Main in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:21:42.990310 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:21:43.988298 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:43.988387 VPN_TO_BJ_Main out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:43.989347 VPN_TO_BJ_Main in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:21:43.989754 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:21:45.002370 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:45.002440 VPN_TO_BJ_Main out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:45.003355 VPN_TO_BJ_Main in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:21:45.003766 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:21:46.016265 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:46.016370 VPN_TO_BJ_Main out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:46.017357 VPN_TO_BJ_Main in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:21:46.017773 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:21:47.030272 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:48.044505 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:49.044927 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:50.058727 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request

2019-03-28 05:21:51.072861 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:51.073083 VPN_TO_BJ_Bak out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:51.074656 VPN_TO_BJ_Bak in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:21:51.075177 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:21:52.071284 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:52.071452 VPN_TO_BJ_Bak out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:52.072792 VPN_TO_BJ_Bak in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:21:52.073240 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:21:53.069390 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:53.069506 VPN_TO_BJ_Bak out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:53.070633 VPN_TO_BJ_Bak in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:21:53.071023 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:21:54.069920 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:54.070024 VPN_TO_BJ_Bak out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:54.071166 VPN_TO_BJ_Bak in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:21:54.071561 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:21:55.084066 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:55.084142 VPN_TO_BJ_Bak out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:21:55.085253 VPN_TO_BJ_Bak in 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:21:55.085646 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

VPN流量再切换回主（整个过程丢包一个，大约也是5秒，此时不会匹配到黑洞路由，因此显示time-out请求超时）：

FortiGate2_ShangHai # diagnose sniffer packet any "host 192.168.0.111 and icmp" 4 0 a
interfaces=[any]
filters=[host 192.168.0.111 and icmp]
2019-03-28 05:24:37.836680 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:37.836819 VPN_TO_BJ_Bak out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:37.837860 VPN_TO_BJ_Bak in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:24:37.838290 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:24:38.836442 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:38.836564 VPN_TO_BJ_Bak out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:38.837630 VPN_TO_BJ_Bak in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:24:38.838058 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:24:39.850598 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:39.850704 VPN_TO_BJ_Bak out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:39.851839 VPN_TO_BJ_Bak in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:24:39.852234 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:24:40.864843 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:40.864965 VPN_TO_BJ_Bak out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:40.866812 VPN_TO_BJ_Bak in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:24:40.867208 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:24:41.863038 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:41.863163 VPN_TO_BJ_Bak out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:41.864277 VPN_TO_BJ_Bak in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:24:41.864677 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:24:42.876928 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:42.877084 VPN_TO_BJ_Bak out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:42.878206 VPN_TO_BJ_Bak in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:24:42.878623 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:24:43.877287 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:43.877422 VPN_TO_BJ_Bak out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:43.878525 VPN_TO_BJ_Bak in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:24:43.878937 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:24:44.891295 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:44.891512 VPN_TO_BJ_Bak out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:44.892568 VPN_TO_BJ_Bak in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:24:44.893067 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:24:45.905495 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:45.905578 VPN_TO_BJ_Bak out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:45.906231 VPN_TO_BJ_Bak in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:24:45.906629 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:24:46.919331 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:46.919471 VPN_TO_BJ_Bak out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:46.920525 VPN_TO_BJ_Bak in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:24:46.920931 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:24:47.935513 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:47.935625 VPN_TO_BJ_Main out 192.168.1.111 -> 192.168.0.111: icmp: echo request

2019-03-28 05:24:52.475017 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:52.475130 VPN_TO_BJ_Main out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:52.476243 VPN_TO_BJ_Main in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:24:52.476747 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:24:53.474473 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:53.474564 VPN_TO_BJ_Main out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:53.475946 VPN_TO_BJ_Main in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:24:53.475939 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:24:54.473744 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:54.473828 VPN_TO_BJ_Main out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:54.474890 VPN_TO_BJ_Main in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:24:54.475291 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

2019-03-28 05:24:55.487522 internal in 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:55.487608 VPN_TO_BJ_Main out 192.168.1.111 -> 192.168.0.111: icmp: echo request
2019-03-28 05:24:55.488685 VPN_TO_BJ_Main in 192.168.0.111 -> 192.168.1.111: icmp: echo reply
2019-03-28 05:24:55.489077 internal out 192.168.0.111 -> 192.168.1.111: icmp: echo reply

58 packets received by filter

0 packets dropped by kernel