In the Fortinet Auto Discovery VPN (ADVPN) hub-and-spoke configuration, when a spoke-to-spoke communication is initiated, the first packet from the spoke FortiGate traverses the hub FortiGate, and then the shortcut process is initiated by the hub.
Once a shortcut is established, subsequent packets are sent directly by the source spoke to the destination spoke, and this communication is transparent to the HUB.
However, if a VIP object in the destination spoke has a underlay IP of the source spoke, it will break the shortcut formations, and traffic to the destination spoke will start flowing through the HUB firewall. This is an expected behavior because, by default, FortiGate considers a VIP as a local IP.
For example:
Spoke-A has an underlay IP 10.9.12.120, and Spoke-B has an underlay IP 10.9.12.135.
VIP on Spoke-B:
config firewall vip
edit "ADVPN VIP"
set uuid 04a7d6a8-722e-51f1-e613-c2792d53248e
set extip 10.9.12.120
set mappedip "172.16.1.2"
set extintf "port1"
next
end
When Spoke-A sources any traffic from 10.9.12.120 to 10.9.12.135, Spoke-B will terminate the reply to itself. As shown in the sniffer below, Spoke-B terminate the reply to the root VDOM.
Sniffer on Spoke-B:
2026-06-27 06:47:00.878994 port1 in 10.9.12.120 -> 10.9.12.135: icmp: echo request
2026-06-27 06:47:00.879174 root out 10.9.12.135 -> 10.9.12.120: icmp: echo reply
2026-06-27 06:47:00.879187 root in 10.9.12.135 -> 10.9.12.120: icmp: echo reply
2026-06-27 06:47:01.879052 port1 in 10.9.12.120 -> 10.9.12.135: icmp: echo request
2026-06-27 06:47:01.879143 root out 10.9.12.135 -> 10.9.12.120: icmp: echo reply
IKE debugs on the destination spoke will display the following error:
Spoke-B:
diagnose debug reset
diagnose vpn ike log filter rem-addr4 <Spoke-A's public IP>
diagnose debug console timestamp enable
diagnose debug application ike -1
diagnose debug enable
The debug logs will include the following:
ike V=root:0:ADVPN:8: local address 10.9.12.120 does not match configuration address 10.9.12.135, drop
To stop the debugging:
diagnose debug disable
diagnose debug reset
The above error will cause issues with shortcut negotiation because the IKE negotiation will not complete successfully. As a result, traffic destined for networks behind Spoke-B will be routed through the HUB instead of using a direct shortcut tunnel.
To fix this issue, delete the VIP object on Spoke-B, as this is not a valid configuration. As a workaround, the ARP reply can be disabled.
config firewall vip
edit "ADVPN VIP"
set uuid 04a7d6a8-722e-51f1-e613-c2792d53248e
set extip 10.9.12.120
set mappedip "172.16.1.2"
set extintf "port1"
set arp-reply disable
next
end
This issue can also impact the non-ADVPN IPsec tunnels. Refer to Technical Tip: IPsec tunnel not coming up with the error 'not match configuration address' and 'drop or could not sned ike'.
Related article:
Technical Tip: ARP reply setting in VIrtual IP/IP pool | 
