I’m working on a Hub‑Spoke IPVPN design across 5 offices, all connected to a central FortiGate hub using IPVPN + BGP (Tunnel‑A). Everything has been stable for years.

Recently I added a second ISP at the hub, and I’m trying to introduce redundancy for the Hub‑Spoke IPVPN topology.

What I built

• At each spoke, I created a second IPVPN tunnel (Tunnel‑B) pointing to the hub’s second ISP.
• Both tunnels (A and B) come up fine on both sides.
• At the hub, both ISP links are in SD‑WAN interface.
• At the spokes, both IPVPN tunnels are in an SD‑WAN zone called IPVPN, with SLA monitoring pointing at servers inside the hub LAN.
• The idea is: Tunnel‑A active → Tunnel‑B standby → automatic failover if Tunnel‑A or ISP‑A goes down.

The problem

Even though both tunnels are up:

• SLA shows Tunnel‑A = alive, Tunnel‑B = dead (but up).
• Tunnel‑B cannot reach the hub LAN for SLA probes.
• If I manually take Tunnel‑A down, traffic does NOT fail over to Tunnel‑B. Instead, the spoke sends traffic out wan1 (Internet) because SD‑WAN marks the IPVPN zone unhealthy.

What I’ve verified

• Both tunnels establish Phase1/Phase2 correctly.
• Hub has separate dial‑in configs for both tunnels.
• Hub firewall policies include both tunnel interfaces.
• Spokes have both tunnels in the IPVPN SD‑WAN zone.
• Static routes exist for the hub LAN.

What I’m trying to achieve

A clean failover design:

Tunnel‑A → Tunnel‑B → Internet (only if both tunnels fail)

Has anyone successfully built dual‑IPVPN failover on FortiGate using SD‑WAN?
Did you run into SLA issues where the second tunnel can’t reach the hub LAN even though the tunnel is up?

Any guidance or examples would be appreciated.

Thanks!

EDIT: On the Hub side, the IPVPN tunnels are Dialup-User and are separated (not members of SDWAN interface) while on the spoke side, the IPVPN tunnels are members of SDWAN interface.