6.3 Advanced IPsec Topologies (Hub-and-Spoke & ADVPN)

6.3 Advanced IPsec Topologies (Hub-and-Spoke & ADVPN)

In large enterprise environments with multiple branch offices, traditional point-to-point IPsec VPN architectures become difficult to scale. Organizations deploy centralized topologies to interconnect branch offices (Spokes) with corporate data centers (Hubs). FortiOS 7.6 provides advanced IPsec architecture capabilities, transitioning from traditional Hub-and-Spoke hairpin topologies to dynamic Auto-Discovery VPN (ADVPN) shortcut architectures. ADVPN combines route-based IPsec tunnels with dynamic routing protocols (BGP) to build scalable, on-demand full-mesh VPN connectivity.

---

Traditional Hub-and-Spoke Topology & The Hairpinning Problem

In a standard Hub-and-Spoke IPsec topology:

• The Hub runs a dial-up IPsec Phase 1 interface (set type dynamic).
• Each Spoke establishes a static IPsec tunnel targeting the Hub's public IP address.
• All traffic between Spoke A and Spoke B must pass through the central Hub.

Traditional Hairpinning Flow:
[Spoke A] -----> (Overlay Tunnel A) -----> [Central Hub] -----> (Overlay Tunnel B) -----> [Spoke B]

Limitations of Hub-and-Spoke Hairpinning

1. Latency Penalty: Data packets between two geographically close branch offices must travel to a potentially distant central Hub and back (tromboning/hairpinning).
2. Hub Bandwidth Bottleneck: The Hub must ingest, decrypt, inspect, re-encrypt, and transmit every packet exchanged between branch offices, consuming double WAN bandwidth.
3. Hub CPU Load: Encrypting and decrypting spoke-to-spoke transit traffic exhausts central FortiGate SPU/NPU crypto offload capacity.

---

Auto-Discovery VPN (ADVPN) Architecture

Auto-Discovery VPN (ADVPN) is a Fortinet proprietary technology that solves the hairpinning problem. ADVPN allows spokes to dynamically negotiate direct peer-to-peer IPsec shortcut tunnels on demand when spoke-to-spoke traffic is detected.

ADVPN Dynamic Shortcut Architecture:
[Spoke A] ================= (Direct Dynamic Shortcut Tunnel) =================> [Spoke B]
    |
    +----------> (Control Signaling & Initial Routing via Hub) --------------------+

ADVPN Control Plane & Packet Flow Sequence

1. Initial Traffic Flow: Spoke A sends an initial data packet destined for Spoke B. Spoke A's routing table routes the packet over its existing parent overlay tunnel to the Hub.
2. Hub Shortcut Notification: The Hub receives the packet from Spoke A and forwards it to Spoke B. Recognizing that both incoming and outgoing interfaces are ADVPN-enabled Phase 1 interfaces, the Hub sends an IKE signaling control message (IKE redirect / shortcut message) to both Spoke A and Spoke B.
3. Dynamic Handshake: The shortcut message informs Spoke A of Spoke B's real public IP address (and vice versa). Spoke A immediately initiates a direct IKE Phase 1 and Phase 2 negotiation with Spoke B over the public internet.
4. Shortcut Tunnel Up: A direct IPsec shortcut tunnel (NAME_0) is established between Spoke A and Spoke B.
5. Routing Update: Dynamic routing (BGP) updates the routing tables on Spoke A and Spoke B, directing subsequent packets directly into the new shortcut tunnel.
6. Idle Teardown: When traffic between Spoke A and Spoke B ceases for longer than the configured idle timeout (set auto-discovery-idle-timeout), FortiOS automatically tears down the dynamic shortcut tunnel to conserve system resources.

---

CLI Configuration of ADVPN

Deploying ADVPN requires specific CLI options on both the Hub and Spoke FortiGate units.

Hub FortiGate Configuration

On the Hub, auto-discovery-sender must be enabled on the Phase 1 dynamic interface, and net-device should be set to disable to allow a single dynamic interface to handle multiple spokes without creating hundreds of virtual interface instances.

config vpn ipsec phase1-interface
    edit "Hub_Advpn_P1"
        set type dynamic
        set interface "port1"
        set ike-version 2
        set proposal aes256-sha256
        set dhgrp 14 19
        set auto-discovery-sender enable
        set net-device disable
        set add-route disable
        set psksecret ENC MTIzNDU2Nzg=
    next
end

config vpn ipsec phase2-interface
    edit "Hub_Advpn_P2"
        set phase1name "Hub_Advpn_P1"
        set proposal aes256-sha256
        set src-subnet 0.0.0.0 0.0.0.0
        set dst-subnet 0.0.0.0 0.0.0.0
    next
end

Spoke FortiGate Configuration

On the Spokes, auto-discovery-receiver and auto-discovery-shortcut must be enabled.

config vpn ipsec phase1-interface
    edit "Spoke_Advpn_P1"
        set interface "port1"
        set ike-version 2
        set peertype any
        set net-device enable
        set proposal aes256-sha256
        set dhgrp 14 19
        set remote-gw 198.51.100.1
        set auto-discovery-receiver enable
        set auto-discovery-shortcut enable
        set psksecret ENC MTIzNDU2Nzg=
    next
end

config vpn ipsec phase2-interface
    edit "Spoke_Advpn_P2"
        set phase1name "Spoke_Advpn_P1"
        set proposal aes256-sha256
        set auto-discovery-shortcut enable
        set src-subnet 0.0.0.0 0.0.0.0
        set dst-subnet 0.0.0.0 0.0.0.0
    next
end

---

BGP Integration & Route Reflector Design

Dynamic routing protocols—specifically Border Gateway Protocol (BGP)—are mandatory for ADVPN operational routing updates.

Crucial BGP Settings for ADVPN

1. Hub as BGP Route Reflector (set route-reflector-client enable):

   • Spokes do not establish full iBGP meshes with each other; they only peer with the central Hub.
   • The Hub reflects prefix updates learned from Spoke A over to Spoke B.

2. Preserve Next-Hop Address (set next-hop-self disable):

   • CRITICAL: On the Hub's BGP neighbor configuration, set next-hop-self must be DISABLED (or set next-hop-self-rr disable).
   • This ensures that when the Hub reflects Spoke B's subnet prefix to Spoke A, the BGP next-hop IP address remains set to Spoke B's tunnel IP (rather than being overwritten with the Hub's IP).
   • When Spoke A sees a BGP next-hop pointing directly to Spoke B's tunnel IP, FortiOS triggers the ADVPN shortcut creation sequence.

# Hub BGP Configuration
config router bgp
    set as 65000
    config neighbor-group
        edit "ADVPN-SPOKES"
            set remote-as 65000
            set route-reflector-client enable
            set next-hop-self disable
        next
    end
end

---

ADVPN Verification & Diagnostics CLI Commands

Administrators can verify shortcut tunnel creation and routing state using the following commands:

# 1. View IPsec tunnels including dynamic shortcuts (indicated by _0, _1 suffix)
get vpn ipsec tunnel summary

# 2. View detailed shortcut tunnel status and public gateway IPs
diagnose vpn tunnel list name Spoke_Advpn_P1_0

# 3. Verify BGP routes and next-hop resolution over shortcut
get router info bgp network

# 4. Debug IKE ADVPN shortcut signaling messages
diagnose debug application ike -1
diagnose debug enable