Skip to main content
52000cc
52000cc
New Member
August 2, 2025
Question

ADVPN hub-and-spoke

  • August 2, 2025
  • 2 replies
  • 715 views

I configured three firewalls, with the HUB using a dial-up. One SPOKE can communicate normally with the HUB. However, after adding another SPOKE, although the IPSEC VPN tunnel was successfully established, the HUB's tunnel IP cannot be pinged. Could you please help identify what the issue might be? Thanks

2 replies

syordanov
Staff
syordanov
Staff
August 4, 2025

Dear 52000cc,

When the second spoke is connect, are you able do an ICMP between both spokes? From second spoke, can you ping the HUB?

IP addresses on the spokes VPN tunnel interface are assigned manually or with mode-config, range?
Please check the KB bellow :

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/820072/advpn-with-bgp-as-the-routing-protocol

Make sure the following:
- Route-reflector-client is enabled only on the HUB;
- Advertise connected network is disabled under BGP routing protocol for this ADVPN ;
- Run a sniffer on the HUB and affected spoke like : diagnose sniffer packet any " host x.x.x.x and icmp" 4 , where x.x.x.x is the HUBs IP address

Best regards,
Fortinet.

52000cc
52000ccAuthor
New Member
August 7, 2025

how can I setup this Advertise connected network is disabled under BGP routing protocol for this ADVPN?

 

VinayHM
Staff
VinayHM
August 4, 2025

Is the tunnel IP advertised in the IPsec?

Terms & ConditionsAccessibility statement