Technical Tip: Implement Hub and Spoke or point to multipoint IPsec - ADVPN disabled
| Description | This article describes how users can implement 'Hub and Spoke' or 'point-to-multipoint' IPSec-ADVPN disabled. |
| Scope | Scenario:
|
| Solution | Diagram:
For full configuration, see: Technical Tip: Implement Hub and Spoke ADVPN – using IPsec wizard.
The spoke-client route must be installed on the routing table (using BGP protocol):
The ADVPN feature is not required, but end-to-end communication between clients behind a spoke or hub node is a requirement. The exchange-interface-ip option is enabled to allow the exchange of IPSec interface IP addresses. This allows a point to multi-point connection to the hub FortiGate. The add-route option is disabled to allow multiple dial-up tunnels to be established to the same host that is advertising the same network. This dynamic network discovery is facilitated by the BGP configuration; see Configure BGP for details.
By default 'exchange-interface-ip' is disabled.
It can seen that 'virtual-interface-addr' has no ip address of their pairing interface.
Spoke-client cannot communicate with another spoke-client.
Enable 'exchange-interface-ip' on ipsec phase1-interface.
Note: If auto-discovery options (sender and receiver) are both disabled, the 'exchange-interface-ip' option is available. However, if either the sender or receiver auto-discovery option is enabled, the 'exchange-interface-ip' option is not available.
'virtual-interface-addr' now has ip address of their pairing interface.
As debug is performed, what is going at the backend can be seen. Debug application ike-1 'add INTERFACE-ADDR4 10.10.10.1' 'update peer route 0.0.0.0 --> 10.10.10.3'
Now both spoke-clients can communicate with one each other.
Test on: FortiGate v. 7.0.6
Fortinet Documentation: vpn ipsec {phase1-interface | phase1} Technical Tip: 'set net-device' new route-based IPsec logic |
