CloudLabBox
Try the free demo

FortiGate SD-WAN lab 6 of 14

Hub-and-spoke IPsec overlays with BGP

Build the classic SD-WAN overlay: a dial-up hub with one IPsec overlay per ISP, two branches with a tunnel over each of their ISPs, iBGP with the hub as route reflector, an overlay zone measured by a health check to the hub's loopback, and a lowest-cost rule that moves corporate traffic to the other overlay when one degrades.

Run this lab

It needs Standard: its 8 nodes are set to 8 vCPU and 9,216 MB in total.

In your workspace: Shared, then FortiGate SD-WAN guided labs, then 06 - Hub-and-spoke IPsec overlays with BGP

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 8 vCPU and 9,216 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 100 minutes
Nodes need
8 vCPU, 9,216 MB
Smallest plan
Standard

The scenario

Kestrel Logistics is joining its depots to head office. HQ's FortiGate (HUB) and both depots (BR1 Leeds, BR2 Bristol) already have SD-WAN on their two ISPs for internet access, as in labs 01 to 03. Now each depot needs an IPsec overlay to HQ over each ISP, so that losing or degrading one ISP never cuts a depot off. Routing will be BGP, so new depots join without anyone editing HQ.

DeviceISP-A (port1)ISP-B (port2)LAN (port3)Overlay A / B tunnel address
HUB203.0.113.1192.0.2.110.1.10.1/24, H1 .50172.16.1.254 / 172.16.2.254, loopback Lo 10.200.0.1
BR1203.0.113.2 (through WAN)192.0.2.210.2.10.1/24, H2 .50172.16.1.2 / 172.16.2.2
BR2203.0.113.3192.0.2.310.3.10.1/24, H3 .50172.16.1.3 / 172.16.2.3
ItemValue
Hub dial-up tunnelsOL_A on port1, OL_B on port2
Spoke tunnelsHUB_A to 203.0.113.1 on port1, HUB_B to 192.0.2.1 on port2
IPsecIKEv2, pre-shared key LabVpnKey1!, proposal des-sha256, DH group 14
BGPAS 65000; HUB is route reflector for 172.16.1.0/24 and 172.16.2.0/24
Spoke SD-WANzone overlay, members 3 (HUB_A) and 4 (HUB_B), health check HUB_HC to 10.200.0.1

Evaluation licence. These FortiGates run with low-strength encryption only, so IPsec offers DES only (des-md5 to des-sha512). The lab uses des-sha256 with DH group 14 so the tunnels work. Never use DES in production: use AES-256-GCM (aes256gcm-prfsha384) with DH group 19, 20 or 21.

What you’ll practise

  • Design overlays: one IPsec tunnel per underlay, a dial-up hub and tunnel addresses
  • Configure a dial-up hub with net-device disable and exchange-interface-ip, and spokes with tunnel addresses
  • Run iBGP over both overlays with the hub as route reflector and BGP multipath on the spokes
  • Put the tunnels in an SD-WAN overlay zone, probe the hub's loopback and steer corporate traffic
  • Prove spoke-to-hub and spoke-to-spoke traffic and an overlay failover

The tasks

  1. Start the lab
  2. Plan the overlay
  3. The hub's dial-up overlays
  4. The spokes' tunnels and overlay zone
  5. BGP over both overlays
  6. Test, then degrade overlay A at Leeds

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Hub-and-spoke IPsec overlays with BGP8 nodes and 2 networks, 12 links. Every link is listed as text below the diagram.HUBBR1BR2INETWANH1H2H3ISP-AISP-Bport1eth0port3eth0eth1port3eth0port3eth0eth0eth1port1port2port2port1port2
8 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HUB port1 to ISP-A (network)
  • HUB port2 to ISP-B (network)
  • HUB port3 to H1 eth0
  • BR1 port1 to WAN eth0
  • WAN eth1 to ISP-A (network)
  • BR1 port2 to ISP-B (network)
  • BR1 port3 to H2 eth0
  • BR2 port1 to ISP-A (network)
  • BR2 port2 to ISP-B (network)
  • BR2 port3 to H3 eth0
  • INET eth0 to ISP-A (network)
  • INET eth1 to ISP-B (network)
Nodes in Hub-and-spoke IPsec overlays with BGP, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HUBFortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
BR1Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
BR2Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
INETEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
WANAlpine WAN emulatorclbalpinewanem-alpine-wanem-3-20-31 vCPU, 512 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H2Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H3Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder FortiGate SD-WAN guided labs.

  3. Open 06 - Hub-and-spoke IPsec overlays with BGP and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More FortiGate SD-WAN labs

All FortiGate SD-WAN labs

Related labs in other courses

CloudLabBox is independent of Fortinet. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.