Vpn – Fortigate 90D SD-WAN: VPN and VoIP

fortigatefortinetvoipvpn

i am contemplating the idea of switching our current FG 80D to a 90D and implement SD-WAN using our current 100Mbit fiber circuit (main) and the 4G LTE (cradlepoint) for internet backup.

Our current ATT router for the main circuit is doing an internal natting for VoIP and using one of the public IP in the block assigned.

No this is the first time i set up SD-WAN and i'am trying to answer a few questions related to it:

If we use the second circuit – cradlepoint (the SIM has a static public IP) with IP Passthrough, internet would of course be up, but what happens to VoIP?
Assuming that just the fiber is down, but the ATT Router is working ok, can the VoIP still be up if the active circuit is now the cradlepoint?
Could i work with subinterfaces to bring a second VPN tunnel up in case we are accessign the internet with the backup circuit?

Thanks,
DT

Best Answer

The public IP is nailed to your AT&T router which will be down when it's down. BGP would be required to tell the Internet that your public IP is now accessible via another link.

I don't know of your VoIP config/topology so I can't say much more without more info. You might be better served configuring a redundant VPN as a foundation. From there, your internal IP traffic (including VoIP packets) would have redundant paths. However, if your VoIP system needs to be reachable via the Internet, there are other steps you might be able to take depending on the VoIP protocol, such as having secondary/failover addresses for whatever VoIP service it is.

Related Solutions

How to pinpoint bandwidth consumers on the Fortigate

This sounds like a case study for sFlow. The best way for you to figure out what's going wrong is to figure out who's talking to who - and how much. Just spin up your favorite sFlow analyzer and start tracking the bandwidth consumption of individual users.

Here's an example sFlow configuration pulled from sflow.com that you'd put on your WAN interface:

config system sflow
   set collector-ip 10.X.X.X
   set collector-port 6343
end

config sys interface
    edit
       set sflow-sampler enable
       set sample-rate 64
       set sample-direction both
       set polling-interval 30
    next
end

^{Configuration snippet pulled from sflow.com, Configuring FortiGate appliances.}

Vpn – FortiGate Site-to-Site VPN with Client VPN

You could try an easy solution: when connected via FortiClient, NAT your source IP address to the HQ network's range. For this, enable 'NAT' in the policy from client tunnel to HQ_LAN. From this point on, your client will be treated as any host on the HQ network, including routing and policing to the branch network.

As an alternative, you could build a second phase2 just for the 10.10.10.x network, on both sides of the HQ-BR tunnel, add this network to the tunnel policies on both sides, and add routes in Branch and on the client PC. That last requirement almost always justifies NATting instead.

Best Answer

Related Solutions

How to pinpoint bandwidth consumers on the Fortigate

Vpn – FortiGate Site-to-Site VPN with Client VPN

Related Topic