| Requirements: CLI and IKEv2. Without the network-id setting, no more than one overlay tunnel can be established with the same pair of underlay IP addresses: FGT-A(192.0.2.1)----------IPSec1-------(203.0.113.2)FGT-B. FGT-A(192.0.2.1)----------IPSec2-------(203.0.113.2)FGT-B <----- Not possible. With the use of the network-id setting, multiple overlay tunnels over the same pair of underlay IP addresses are possible. FGT-A(192.0.2.1)----------IPSec1-------(203.0.113.2)FGT-B. FGT-A(192.0.2.1)----------IPSec2-------(203.0.113.2)FGT-B <----- Possible. 
Use case of Network IDs: With ADVPN, it is possible to leverage the Network-ids to configure multiple shortcut tunnels on the branches that only have a single ISP. Branch1(port1:x.x.x.x)---advpn1---(port:y.y.y.y) Branch2. Branch1(port1:x.x.x.x)---advpn2---(port:y.y.y.y) Branch2. Example: - Branch1 and Branch2 have a single Internet access (ISP) and the Hub has two ISPs.
- Two overlay tunnels are built between each Branch and the Hub advpn1 and advpn2.
- Initially, traffic from the Branch1 to Branch2 will pass via B1---advpn1---HUB--advpn1--B2.
- The Hub will facilitate a shortcut tunnel negotiation between Branch1 and Branch2 over advpn1.
- A shortcut tunnel over advpn1 is established between Branch1 and Branch2. B1(port1)==Shortcut_advpn1==(port1)B2.
- Traffic from Branch1 to Branch2 will traverse over the Shortcut_advpn1.
- If ISP-1 on the HUB goes down:
- The Parent tunnel between Hub(ISP-1) and Branch1 will go down, and the same will happen between Hub(ISP-1) and Branch2.
- However, the Shortcut tunnel B1(port1)====Shortcut_advpn1====(port1)B2 will stay up, as the lifetime of an ADVPN shortcut is independent of the lifetime of its original parent tunnel.
- Branch1<->Hub and Branch2<->Hub BGP peering over advpn1 goes down.
- Routing between B1 and B2 converge over advpn2 via the Hub:
- Traffic from B1 to B2 flows through the Hub, since there is no shortcut yet between B1 and B2 over advpn2.
- The Hub will try to facilitate a shortcut tunnel between Branch1 and Branch2 over advpn2.
If Network-id is configured: Shortcut over advpn2 will establish between Branch1 and Branch2 over advpn2: - Shortcuts for advpn2 and advpn1 are both established over the same underlay IP addresses Branch1/port1 ↔ Branch2/port1.
- These two 'overlapping' shortcuts can be simultaneously established because different network-id are configured for each overlay tunnel.
- After routing has converged, traffic flows through the advpn2 shortcut:
B1(port1:x.x.x.x)---Shortcut_advpn1---(port:y.y.y.y) B2. B1(port1:x.x.x.x)---Shortcut_advpn2---(port:y.y.y.y) B2. 
If Network-id is not configured: Shortcut-offer over advpn2 is ignored by Branch1 and Branch2. - Because there already exists a shortcut (advpn1) over the same underlay IP addresses, Branch1/port1 ↔ Branch2/port1. Two 'overlapping' shortcuts cannot be simultaneously established without configuring a different network-id for each overlay tunnel.
- As long as the advpn1 shortcut is up, if Branch1 sends any traffic to Branch2 over advpn2, it will go through a hub, as no shortcut tunnels between both Branches will be established over advpn2.
Network ID configuration. On the Hub side: config vpn ipsec phase1-interface edit "advpn1" set type dynamic set interface "port1" set ike-version 2 set network-overlay enable set network-id 1 ... next edit "advpn2" set type dynamic set interface "port2" set ike-version 2 set network-overlay enable set network-id 2 ... next end On the spokes: config vpn ipsec phase1-interface edit "advpn1" set ike-version 2 set interface "port1" set remote-gw x.x.x.x set network-overlay enable set network-id 1 ... next edit "advpn2" set ike-version 2 set interface "port1" set remote-gw y.y.y.y set network-overlay enable set network-id 2 ... next end For criss-cross configuration:
HUB side: HUB1 (Hub -> Tata Tunnel): network-id 1
HUB2 (Hub -> Airtel Tunnel): network-id 2
HUB3 (Hub Airtel -> Spoke Tata): network-id 3
HUB4 (Hub Tata -> Spoke Airtel): network-id 4 Spoke:
Spoke Tata -> Hub Tata: network-id 1
Spoke Airtel -> Hub Airtel: network-id 2
Spoke Tata -> Hub Airtel: network-id 3
Spoke Airtel -> Hub Tata: network-id 4
Hub configuration example:
Hub -> Tata Tunnel:
config vpn ipsec phase1-interface
edit "TATA-SPOKE-TATA"
set interface "TATA-WAN"
set ike-version 2
set peertype any
set net-device disable
set network-id 1
set exchange-ip-addr4 x.x.x.x
next
end
Hub -> Airtel Tunnel:
edit "AIRTEL-SPOKE-AIRTEL"
set interface "AIRTEL-WAN"
set net-device disable
set network-id 2
set exchange-ip-addr4 x.x.x.x
next
Hub Airtel <-> Spoke Tata: edit "AIRTEL-SPOKE-TATA"
set interface "AIRTEL-WAN"
set network-id 3
set net-device disable
next Hub Tata <-> Spoke Airtel: edit "TATA-SPOKE-AIRTEL"
set interface "TATA-WAN"
set network-id 4
set net-device disable
next Spoke Configuration Example: Spoke Tata -> Hub Tata: config vpn ipsec phase1-interface
edit "TATA-HUB-TATA"
set interface "TATA-WAN"
set network-id 1
set net-device disable
next
end Spoke Airtel -> Hub Airtel:
edit "AIRTEL-HUB-AIRTEL"
set interface "AIRTEL-WAN"
set network-id 2
set net-device disable
next
Spoke Tata -> Hub Airtel:
edit "TATA-HUB-AIRTEL"
set interface "TATA-WAN"
set network-id 3
set net-device disable
next
Spoke Airtel -> Hub Tata: edit "AIRTEL-HUB-TATA"
set interface "AIRTEL-WAN"
set network-id 4
set net-device disable
next Notes: - IKEv1 does not support Network IDs.
- For IKEv1 Shortcut tunnels, dependency can be enabled so that once the parent tunnel goes down, the Shortcut tunnel over that parent tunnel will also go down.
- Make sure the network IDs match to spoke and hub firewall; if there is a mismatch in the network ID, then the tunnel will get established to a different tunnel.
- Using the network ID on IKEv2, it is possible to have multiple shortcuts between two spokes, even if there is a single Internet access on each Spoke.
- The network ID is not taken into account during shortcut (spoke-to-spoke tunnel) negotiation. It is possible for Spoke B1, which connects to the HUB via network-id 1, to negotiate a direct shortcut tunnel with Spoke B2, which connects to the same HUB via network-id 2.
- The network ID is an overlay ID and not an ADVPN domain ID; it allows cross-overlay shortcuts. However, there is an option to block cross-overlay shortcuts. (Technical Tip: Usage of ‘auto-discovery-crossover’ option in ADVPN setup).
| 
