A substation FortiGate has two internet-facing WAN links for redundancy, and the utility wants the site-to-site IPsec tunnel to the NOC to automatically fail over to the backup WAN link if the primary link goes down, without an engineer having to reconfigure the tunnel by hand. Beyond the IPsec tunnel itself, what must also be addressed for this failover to actually work end to end?
Select an answer to reveal the explanation.
Short Explanation
IPsec doesn't just magically hop to a different WAN link on its own — it still needs an actual reachable path to the NOC's endpoint over that backup connection. Without routing that gets the tunnel to a working WAN interface after a failure, phase 1 has nothing to re-negotiate over.
Full Explanation
For an IPsec tunnel to survive a WAN failover, the substation FortiGate needs underlying routing and reachability to the NOC's phase 1 remote gateway over whichever WAN interface becomes active — for example, through SD-WAN rules, a backup default route, or a failover configuration that shifts the phase 1 interface binding — because IPsec itself has no independent path-selection intelligence; it simply attempts to reach the configured remote gateway using whatever route the FortiGate's routing table currently provides. The claim that phase 1 and phase 2 automatically detect and use any available WAN interface is false — without a routing mechanism actively redirecting traffic to the backup link, the tunnel has no way to reach the NOC and will simply stay down after the primary link fails. A separate pre-shared key for the backup WAN interface is unnecessary; the same phase 1 authentication configuration applies regardless of which physical interface is used to reach the remote gateway, since PSK authentication is tied to the peer identity, not to a specific local WAN port. Disabling dead peer detection would not help failover and is based on a false premise — DPD's purpose is to detect a peer that has gone unreachable and tear down the stale SA so a fresh negotiation can occur; disabling it would actually leave a dead tunnel lingering longer rather than helping the tunnel move to a new path faster. A practical validation step is to simulate a primary WAN failure in a maintenance window and confirm, via 'diagnose vpn ike gateway list', that the phase 1 gateway re-establishes over the backup interface within the expected time.