# remember to add the default gateway associated with wan1 # # port 7 firewall must be configured in trunk on switch port #

Ive confirmed offloading is active on both ends. And traffic takes a U-turn to reach private IP address of server Thats why it is called Hairpin or Loopback NAT. In testing, Ive noticed that Im only able to eek out 100M of performance over the VPN. # Virtual Switch Configuration for bridge between native vxlan and port 7. Ive got a pair of FortiGate 1000Ds (HA) running 5.4.8 that, for reasons, need to be able to terminate a site to site VPN tunnel to a loopback interface. # native vxlan configuration using vpn ipsec with loopback interface # With this configuration, traffic with the native vxlan is encrypted with the IPSECĪttached the configuration adopted between fortigate 80E and Fortigate 90E I decided to make a configuration using IPSEC with loopback interface and use the native vxlan with the loopback interfaces. native vxlan supports 802.1q (instead internet traffic is not encrypted) To configure the loopback interface using the GUI: Go to Network > Interfaces.vxlan over ipsec does not support 802.1q (while internet traffic is encrypted).But I an unable to add loopback interfaces to a zone. We have couple FGT-300D devices running FortiOS v5.2.6,build711 GA and we are migrating configuration and policies to zone from interfaces (physical and VLANs).

I allow myself to write this post because I have a lot of difficulty in configuring vxlan over ipsec, the operation is not guaranteed (at least from my experience)įrom the FortiOS version 5.6.2 vxlan can be used natively FortiGate unable to add loopback interface to zone.

Fortigate loopback interface