Technical Tip: ADVPN shortcut tunnels has multiple IPs which breaks the communication between spokes

This article describes the reason why sometimes ADVPN shortcut tunnels will be up, but communication fails between them.

Explanation:

ADVPN tunnel IP address should be the same for the main ADVPN tunnel and Shortcut tunnels; if the IP addresses are different, then the communication to that spoke will break.

Run the command 'diagnose ip address list'.

diagnose ip address list

IP=10.254.0.85->10.254.0.85/255.255.252.0 index=36 devname=ADVPN_PRI

IP=10.254.0.79->10.254.0.49/255.255.255.255 index=89 devname=ADVPN_PRI_0

IP=10.254.0.85->10.254.0.49/255.255.255.255 index=108 devname=ADVPN_PRI_1

In the above output, the ADVPN_PRI and ADVPN_PRI_1 has 10.254.0.85, but the ADVPN_PRI_0 has 10.254.0.49.

The BGP Route is shown below:

get router info routing-table details 10.120.130.0/18

Routing table for VRF=0

Routing entry for 10.120.130.0/18

  Known via "bgp", distance 200, metric 0, best

  Last update 00:06:17 ago

  * 10.254.0.49, via ADVPN_PRI_0 distance 0 <----- Shows via 'ADVPN_PRI_0', instead it should be 'ADVPN_PRI_1'.

  * 10.254.0.49, via ADVPN_PRI_0 distance 0 <-----Shows via 'ADVPN_PRI_0', instead it should be 'ADVPN_PRI_1'.

Solution:

set 'auto-discovery-shortcuts dependent' on all the spokes.

auto-discovery-shortcuts: Control deletion of child shortcut tunnels when the parent tunnel goes down.

By default, shortcuts are not brought down if the parent tunnel goes down. The lifetime of a shortcut is independent of its parent tunnel. 

independent (Default): Shortcut tunnels remain up if the parent tunnel goes down.

dependent: Shortcut tunnels are brought down if the parent tunnel goes down.

config vpn ipsec phase1-interface

    edit <phase1name>

        set auto-discovery-shortcuts [independent|dependent]

    next
end

When the Primary tunnel goes down for some reason, it comes back with a different IP assigned by mode-cfg to the Spoke Device VPN tunnel. The 'dependent' option helps to delete the shortcut tunnels when the parent tunnel goes down.

To save resources and obtain a faster routing convergence, instruct FortiGate to bring down a shortcut immediately after its parent tunnel goes down when the 'set auto-discovery-shortcuts' is 'dependent'.

In v7.2.0, 'dependent' is the Default Option.

Note:

As of v7.0.8 and v7.2.0, 'auto-discovery-shortcuts independent' cannot be set on an IPsec tunnel when 'set mode-config enable' is also set. This is because mode-config uses the hub FortiGate to assign dynamic IP addresses to spoke FortiGates.

If a spoke were to receive a different tunnel overlay IP address from the hub FortiGate after reconnecting to the hub, then any existing shortcut tunnels would break.