Skip to main content
M
Malam
Visitor II
June 16, 2026
Question

ADVPN Spoke to Spoke Not communicating

  • June 16, 2026
  • 7 replies
  • 209 views
HI everyone i am deploying Hub and Spoke ADVPN BGP over Loopback Topology in Real Environemnt . After Deploy full configuration follow by Fortinett Documents i can see Spoke A can talk to Hub and Spoke B can talk to Hub but when Spoke A try to Talk to Spoke B it create Shortcut Tunnel but after shortcut they cannot talk to Each other... When i check in Spoke A routes for Spoke B it showing next hope Underlay/WAN not Overlay/VPN. same at Spoke B for Spoke A . can anyone know that in BGP Over loopback what could be the issue that Spoke to Spoke cannot send traffic via Overlay after shortcut?

Port1 and Port2 are WAN Underlay Ports .

Spoke-A-Dent # get router info routing-table all

Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP

O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

* - candidate default

Routing table for VRF=0

S* 0.0.0.0/0 [1/0] via 192.168.3.254, port1, [1/0]

[1/0] via 192.168.4.254, port2, [1/0]

C 10.0.1.64/26 is directly connected, Com-ADVPN

C 10.0.1.65/32 is directly connected, Com-ADVPN

B 172.16.254.0/24 [200/0] via 172.16.254.252 (recursive via Com-ADVPN tunnel 192.168.3.252), 00:21:13

C 172.16.254.1/32 is directly connected, BGP-LO

B 172.16.254.2/32 [200/0] via 172.16.254.2 (recursive via 192.168.3.254, port1), 00:20:07

(recursive via 192.168.4.254, port2), 00:20:07

S 172.16.254.252/32 [15/0] via Com-ADVPN tunnel 192.168.3.252, [1/0]

B 172.31.220.0/24 [200/0] via 172.16.254.2 (recursive via 192.168.3.254, port1), 00:20:07

(recursive via 192.168.4.254, port2), 00:20:07

B 172.31.247.0/24 [200/0] via 172.16.254.252 (recursive via Com-ADVPN (ADVPN )tunnel 192.168.3.252), 00:21:13

C 172.31.253.0/24 is directly connected, port3(LAN)

C 192.168.3.0/24 is directly connected, port1(WAN Internet Port)

C 192.168.4.0/24 is directly connected, port2(WAN Internet Port)

7 replies

funkylicious
SuperUser
funkylicious
SuperUser
June 16, 2026

is this the guide you’ve followed ?

what are the networks on Spoke-A and on Spoke-B ?

can you share the output for, show router bgp 

"jack of all trades, master of none"
msanjaypadma
Staff
msanjaypadma
Staff
June 16, 2026

Hi ​@Malam ,

From what I understand, you are referring to the following route:

B 172.31.220.0/24 [200/0] via 172.16.254.2 (recursive via 192.168.3.254, port1), 00:20:07 
 

This issue typically occurs when the route for the next-hop IP address (172.16.254.2) is learn by BGP in the routing table.  By default, BGP routes are not considered when a BGP next hop requires recursive resolution.

As a result, the route points to the default gateway, which in your case is the default route:
 [S* 0.0.0.0/0 [1/0] via 192.168.3.254, port1]   

Consequently, the interface shows as port1 as the exit interface.

They are considered when recursive-next-hop is enabled. Recursive resolution will resolve to one level.

I have observed that you are currently receiving both the specific host subnet [172.16.254.2/32] and the  subnet [172.16.254.0/24] from HUB to Spoke firewall. 
In this case, advertising from the HUB to Spoke just the /24 subnet should be sufficient. To simplify the configuration and ensure proper routing, enable the following feature:

Spoke :

config router bgp
    set recursive-next-hop enable <-----
end

Once you enabled, share your feedback ! 

Don’t forgot to soft clear the BGP

If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.
 

Thanks, Mayur Padma
M
MalamAuthor
Visitor II
June 17, 2026

Hi Team Yeah i am following this Configurati (

 ​@msanjaypadma msanjaypadma Thanks for your response i need one more clarification where i need to Enable next hope Self? on Hub? or Both Spokes? or only Both Spokes not on Hub? also what is mean by additional Path enable Both in Both Spokes under neighbour what it does? well i can yeah today i will going to configured from scratch on my lab and will update but i need those Question clarification also  can you please tell me or explain me what will be the Source IP and dst IP in SDWAN Rules for ADVPN? e.g i have 1 hub and 10 Spokes ? also how many Policies i need to creat in Hub ? can you send me those Policies like from SRC Int Dst Int and Src IP and Dst IP as i have 1 Hub and 10 Spokes. it will be very greatful 

msanjaypadma
Staff
msanjaypadma
Staff
June 17, 2026

Please ensure to review the attached document carefully. It clearly states that Next-hop-self should be disabled in the ADVPN design, as enabling it can disrupt the ADVPN setup.

Additionally, I suggested enabling recursive-next-hop only on the Spoke, not on the HUB.

For further clarification on the additional path configuration, please refer to the article linked below. It provides a detailed explanation with examples. 


Regarding the SD-WAN rule, this can be configured later as it pertains to traffic steering.

For the firewall policy, ensure that on both the Spoke and HUB, the tunnel interface is included in the policy to establish the tunnel. You can then configure other policies based on the specific traffic you wish to permit.

If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.
 

Thanks, Mayur Padma
M
MalamAuthor
Visitor II
June 17, 2026

Thanks ​@msanjaypadma I configured 1 Spoke vs 1 hub and another Spoke is stuck on BGP Connect as same Configuraion of Spoke A just Lo IP changed same setting same configuration but it stuck on Connect State also for Policies i just put all the Lo and Overlay Tunnel in eash policies and yeah i will not enable next hope self on each Sites also i will reomve recursive next hop i will let you know after done with Spoke B and checking why it stuck on Conncet State as VPN is up 

M
MalamAuthor
Visitor II
June 17, 2026

​@msanjaypadma  now this what i am got stuck so all BGP is UP all routes are good  shortcut is up but SPoke A ccannot react to Spoke B i can see in routing table but no communicationg 

Hub Admin Routing 

Admin-HA # 
Admin-HA # get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default

Routing table for VRF=0
S*      0.0.0.0/0 [1/0] via 192.168.1.254, port1, [1/0]
                  [1/0] via 192.168.2.254, port2, [1/0]
S       172.16.254.0/24 [252/0] is a summary, Null, [1/0]
S       172.16.254.1/32 [15/0] via VER-1 tunnel 10.0.1.2, [1/0]
S       172.16.254.2/32 [15/0] via VER-1 tunnel 10.0.1.1, [1/0]
C       172.16.254.252/32 is directly connected, BGP-LO
C       172.16.254.253/32 is directly connected, BGP-Health
B       172.31.220.0/24 [200/0] via 172.16.254.2 (recursive via VER-1 tunnel 10.0.1.1), 00:02:16
C       172.31.247.0/24 is directly connected, port3
B       172.31.253.0/24 [200/0] via 172.16.254.1 (recursive via VER-1 tunnel 10.0.1.2), 00:02:18
C       192.168.1.0/24 is directly connected, port1
C       192.168.2.0/24 is directly connected, port2

 

 

Spoke A Dent Routing 

 

Dent-SpokeA # get rout info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default

Routing table for VRF=0
S*      0.0.0.0/0 [1/0] via 192.168.3.254, port1, [1/0]
                  [1/0] via 192.168.4.254, port2, [1/0]
C       10.0.1.0/26 is directly connected, Com-ADVPN
C       10.0.1.2/32 is directly connected, Com-ADVPN
C       172.16.254.1/32 is directly connected, Branch-LO
B       172.16.254.2/32 [200/0] via 172.16.254.2 tag 1 (recursive via 192.168.3.254, port1), 00:02:40
                                                       (recursive via 192.168.4.254, port2), 00:02:40
S       172.16.254.252/32 [15/0] via Com-ADVPN tunnel 192.168.1.252, [1/0]
B       172.31.220.0/24 [200/0] via 172.16.254.2 tag 1 (recursive via 192.168.3.254, port1), 00:02:40
                                                       (recursive via 192.168.4.254, port2), 00:02:40
B       172.31.247.0/24 [200/0] via 172.16.254.252 tag 1 (recursive via Com-ADVPN tunnel 192.168.1.252), 00:02:43
C       172.31.253.0/24 is directly connected, port3
C       192.168.3.0/24 is directly connected, port1
C       192.168.4.0/24 is directly connected, port2

Spoke B Flint Routing

 

Routing table for VRF=0
S*      0.0.0.0/0 [1/0] via 192.168.5.254, port1, [1/0]
C       10.0.1.0/26 is directly connected, Com-ADVPN
C       10.0.1.1/32 is directly connected, Com-ADVPN
B       172.16.254.1/32 [200/0] via 172.16.254.1 tag 1 (recursive via 192.168.5.254, port1), 00:02:34
C       172.16.254.2/32 is directly connected, BGP-LO
S       172.16.254.252/32 [15/0] via Com-ADVPN tunnel 192.168.1.252, [1/0]
C       172.31.220.0/24 is directly connected, port3
B       172.31.247.0/24 [200/0] via 172.16.254.252 tag 1 (recursive via Com-ADVPN tunnel 192.168.1.252), 00:02:34
B       172.31.253.0/24 [200/0] via 172.16.254.1 tag 1 (recursive via 192.168.5.254, port1), 00:02:34
C       192.168.5.0/24 is directly connected, port1

Spoke-B-Flint # Spoke-B-Flint # get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default

Routing table for VRF=0
S*      0.0.0.0/0 [1/0] via 192.168.5.254, port1, [1/0]
C       10.0.1.0/26 is directly connected, Com-ADVPN
C       10.0.1.1/32 is directly connected, Com-ADVPN
B       172.16.254.1/32 [200/0] via 172.16.254.1 tag 1 (recursive via 192.168.5.254, port1), 00:04:07
C       172.16.254.2/32 is directly connected, BGP-LO
S       172.16.254.252/32 [15/0] via Com-ADVPN tunnel 192.168.1.252, [1/0]
C       172.31.220.0/24 is directly connected, port3
B       172.31.247.0/24 [200/0] via 172.16.254.252 tag 1 (recursive via Com-ADVPN tunnel 192.168.1.252), 00:04:07
B       172.31.253.0/24 [200/0] via 172.16.254.1 tag 1 (recursive via 192.168.5.254, port1), 00:04:07
C       192.168.5.0/24 is directly connected, port1

===========================================================

Hub BGP VPN configuration

 

Admin-HA # Admin-HA # 
Admin-HA # conf vpn ipsec phase1-interface 

Admin-HA (phase1-interface) # show
config vpn ipsec phase1-interface
    edit "VER-1"
        set type dynamic
        set interface "port1"
        set ike-version 2
        set peertype any
        set net-device disable
        set exchange-ip-addr4 172.16.254.252
        set mode-cfg enable
        set proposal des-sha256
        set add-route disable
        set dpd on-idle
        set comments "Comcast_ISP-WAN1"
        set auto-discovery-sender enable
        set network-overlay enable
        set network-id 1
        set ipv4-start-ip 10.0.1.1
        set ipv4-end-ip 10.0.1.60
        set ipv4-netmask 255.255.255.192
        set psksecret ENC q0Af5CCHn96OvrwFipV7FjVKTe3mTGC8XTRv9TF3BYuqzlpxEebAvXDCcxAE2QN0VUyh8x95oGpzqi1foMORlr1v4WvjdPzjRyXZsQKmlqqGqLhyrL874kGyG2DxNsFvfwudAWTu3Zkn5DHPtAR60I0BlJtx5dwv/QStSzleHjVqIV7MvWBbRJEen26pIoI6jq7stQ==
        set dpd-retryinterval 5
    next

============================

Spoke A Dent VPN Configuraoni

 

Dent-SpokeA # con vpn ipsec phase1-interface 

Dent-SpokeA (phase1-interface) # 
Dent-SpokeA (phase1-interface) # show
config vpn ipsec phase1-interface
    edit "Com-ADVPN"
        set interface "port1"
        set ike-version 2
        set peertype any
        set net-device enable
        set exchange-ip-addr4 172.16.254.1
        set mode-cfg enable
        set proposal des-sha256
        set localid "any"
        set comments "VPN:Com-To-Hub-Com"
        set idle-timeout enable
        set idle-timeoutinterval 5
        set auto-discovery-receiver enable
        set auto-discovery-shortcuts dependent
        set network-overlay enable
        set network-id 1
        set remote-gw 192.168.1.252
        set psksecret ENC 1guo7bzzsjn8sjv5agBxy4+Fdhkt3jtwqqtWKDoztuC7Jwp6gvUfBlnV8D36oqeFdARPW0TvV8g1+erfE6oRXiYu+mpnhIiBB63YAnERbavJFndghFTleEP5e9WVG2asuzB8XGtmAWrsPoCcA4wkihIRjLEMifIEuJpjugSok4BrB1f24qx4vu/QAoYIqq+GnZHMgQ==
        set dpd-retryinterval 3
    next
==================================

 

Spoke B Configuraion VPN 

 


Spoke-B-Flint (phase1-interface) # show
config vpn ipsec phase1-interface
    edit "Com-ADVPN"
        set interface "port1"
        set ike-version 2
        set peertype any
        set net-device enable
        set exchange-ip-addr4 172.16.254.2
        set mode-cfg enable
        set proposal des-sha256
        set localid "any"
        set comments "VPN:Com-To-HUB Com"
        set idle-timeout enable
        set idle-timeoutinterval 5
        set auto-discovery-receiver enable
        set auto-discovery-shortcuts dependent
        set network-overlay enable
        set network-id 1
        set remote-gw 192.168.1.252
        set psksecret ENC Cx/kpobjqFhmOOqExKeLIUBKZvi4Jzz2+GoIf6VH9fefbkn+TwGRk5FLOtP1IYyhMFzNW+XF+ZgRWwwUd6uX7VXUDkHimSB07c38j2FCl6rHUTCscn/OOtX82kLf3gj2NBu+gU9fZ8jzrBtQW3DY71oPPsq+7MEdsBenhs9AO61Hwh+1VwcpvsSywQGR9t2RGgxDzg==
        set dpd-retryinterval 3
    next
end

Spoke-B-Flint (phase1-interface) # 

 

please check and help me why Spoke A ccannot talk to Spoke b if there is everything 

 

Admin-HA # get router info bgp  summary 
VRF 0 BGP router identifier 172.16.254.252, local AS number 65000
BGP table version is 4
1 BGP AS-PATH entries
0 BGP community entries
Next peer check timer due in 31 seconds

Neighbor     V         AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
172.16.254.1 4      65000     200     231        3    0    0 00:06:56        2
172.16.254.2 4      65000     100     120        2    0    0 00:06:54        2

Total number of neighbors 2

 

Admin-HA # 

 

 

 

 

 

 

 

 

 

M
MalamAuthor
Visitor II
June 18, 2026

​@msanjaypadma  now this what i am got stuck so all BGP is UP all routes are good  shortcut is up but SPoke A ccannot react to Spoke B i can see in routing table but no communicationg 

Hub Admin Routing 

Admin-HA # 
Admin-HA # get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default

Routing table for VRF=0
S*      0.0.0.0/0 [1/0] via 192.168.1.254, port1, [1/0]
                  [1/0] via 192.168.2.254, port2, [1/0]
S       172.16.254.0/24 [252/0] is a summary, Null, [1/0]
S       172.16.254.1/32 [15/0] via VER-1 tunnel 10.0.1.2, [1/0]
S       172.16.254.2/32 [15/0] via VER-1 tunnel 10.0.1.1, [1/0]
C       172.16.254.252/32 is directly connected, BGP-LO
C       172.16.254.253/32 is directly connected, BGP-Health
B       172.31.220.0/24 [200/0] via 172.16.254.2 (recursive via VER-1 tunnel 10.0.1.1), 00:02:16
C       172.31.247.0/24 is directly connected, port3
B       172.31.253.0/24 [200/0] via 172.16.254.1 (recursive via VER-1 tunnel 10.0.1.2), 00:02:18
C       192.168.1.0/24 is directly connected, port1
C       192.168.2.0/24 is directly connected, port2

 

 

Spoke A Dent Routing 

 

Dent-SpokeA # get rout info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default

Routing table for VRF=0
S*      0.0.0.0/0 [1/0] via 192.168.3.254, port1, [1/0]
                  [1/0] via 192.168.4.254, port2, [1/0]
C       10.0.1.0/26 is directly connected, Com-ADVPN
C       10.0.1.2/32 is directly connected, Com-ADVPN
C       172.16.254.1/32 is directly connected, Branch-LO
B       172.16.254.2/32 [200/0] via 172.16.254.2 tag 1 (recursive via 192.168.3.254, port1), 00:02:40
                                                       (recursive via 192.168.4.254, port2), 00:02:40
S       172.16.254.252/32 [15/0] via Com-ADVPN tunnel 192.168.1.252, [1/0]
B       172.31.220.0/24 [200/0] via 172.16.254.2 tag 1 (recursive via 192.168.3.254, port1), 00:02:40
                                                       (recursive via 192.168.4.254, port2), 00:02:40
B       172.31.247.0/24 [200/0] via 172.16.254.252 tag 1 (recursive via Com-ADVPN tunnel 192.168.1.252), 00:02:43
C       172.31.253.0/24 is directly connected, port3
C       192.168.3.0/24 is directly connected, port1
C       192.168.4.0/24 is directly connected, port2

Spoke B Flint Routing

 

Routing table for VRF=0
S*      0.0.0.0/0 [1/0] via 192.168.5.254, port1, [1/0]
C       10.0.1.0/26 is directly connected, Com-ADVPN
C       10.0.1.1/32 is directly connected, Com-ADVPN
B       172.16.254.1/32 [200/0] via 172.16.254.1 tag 1 (recursive via 192.168.5.254, port1), 00:02:34
C       172.16.254.2/32 is directly connected, BGP-LO
S       172.16.254.252/32 [15/0] via Com-ADVPN tunnel 192.168.1.252, [1/0]
C       172.31.220.0/24 is directly connected, port3
B       172.31.247.0/24 [200/0] via 172.16.254.252 tag 1 (recursive via Com-ADVPN tunnel 192.168.1.252), 00:02:34
B       172.31.253.0/24 [200/0] via 172.16.254.1 tag 1 (recursive via 192.168.5.254, port1), 00:02:34
C       192.168.5.0/24 is directly connected, port1

Spoke-B-Flint # Spoke-B-Flint # get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
       O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default

Routing table for VRF=0
S*      0.0.0.0/0 [1/0] via 192.168.5.254, port1, [1/0]
C       10.0.1.0/26 is directly connected, Com-ADVPN
C       10.0.1.1/32 is directly connected, Com-ADVPN
B       172.16.254.1/32 [200/0] via 172.16.254.1 tag 1 (recursive via 192.168.5.254, port1), 00:04:07
C       172.16.254.2/32 is directly connected, BGP-LO
S       172.16.254.252/32 [15/0] via Com-ADVPN tunnel 192.168.1.252, [1/0]
C       172.31.220.0/24 is directly connected, port3
B       172.31.247.0/24 [200/0] via 172.16.254.252 tag 1 (recursive via Com-ADVPN tunnel 192.168.1.252), 00:04:07
B       172.31.253.0/24 [200/0] via 172.16.254.1 tag 1 (recursive via 192.168.5.254, port1), 00:04:07
C       192.168.5.0/24 is directly connected, port1

===========================================================

Hub BGP VPN configuration

 

Admin-HA # Admin-HA # 
Admin-HA # conf vpn ipsec phase1-interface 

Admin-HA (phase1-interface) # show
config vpn ipsec phase1-interface
    edit "VER-1"
        set type dynamic
        set interface "port1"
        set ike-version 2
        set peertype any
        set net-device disable
        set exchange-ip-addr4 172.16.254.252
        set mode-cfg enable
        set proposal des-sha256
        set add-route disable
        set dpd on-idle
        set comments "Comcast_ISP-WAN1"
        set auto-discovery-sender enable
        set network-overlay enable
        set network-id 1
        set ipv4-start-ip 10.0.1.1
        set ipv4-end-ip 10.0.1.60
        set ipv4-netmask 255.255.255.192
        set psksecret ENC q0Af5CCHn96OvrwFipV7FjVKTe3mTGC8XTRv9TF3BYuqzlpxEebAvXDCcxAE2QN0VUyh8x95oGpzqi1foMORlr1v4WvjdPzjRyXZsQKmlqqGqLhyrL874kGyG2DxNsFvfwudAWTu3Zkn5DHPtAR60I0BlJtx5dwv/QStSzleHjVqIV7MvWBbRJEen26pIoI6jq7stQ==
        set dpd-retryinterval 5
    next

============================

Spoke A Dent VPN Configuraoni

 

Dent-SpokeA # con vpn ipsec phase1-interface 

Dent-SpokeA (phase1-interface) # 
Dent-SpokeA (phase1-interface) # show
config vpn ipsec phase1-interface
    edit "Com-ADVPN"
        set interface "port1"
        set ike-version 2
        set peertype any
        set net-device enable
        set exchange-ip-addr4 172.16.254.1
        set mode-cfg enable
        set proposal des-sha256
        set localid "any"
        set comments "VPN:Com-To-Hub-Com"
        set idle-timeout enable
        set idle-timeoutinterval 5
        set auto-discovery-receiver enable
        set auto-discovery-shortcuts dependent
        set network-overlay enable
        set network-id 1
        set remote-gw 192.168.1.252
        set psksecret ENC 1guo7bzzsjn8sjv5agBxy4+Fdhkt3jtwqqtWKDoztuC7Jwp6gvUfBlnV8D36oqeFdARPW0TvV8g1+erfE6oRXiYu+mpnhIiBB63YAnERbavJFndghFTleEP5e9WVG2asuzB8XGtmAWrsPoCcA4wkihIRjLEMifIEuJpjugSok4BrB1f24qx4vu/QAoYIqq+GnZHMgQ==
        set dpd-retryinterval 3
    next
==================================

 

Spoke B Configuraion VPN 

 


Spoke-B-Flint (phase1-interface) # show
config vpn ipsec phase1-interface
    edit "Com-ADVPN"
        set interface "port1"
        set ike-version 2
        set peertype any
        set net-device enable
        set exchange-ip-addr4 172.16.254.2
        set mode-cfg enable
        set proposal des-sha256
        set localid "any"
        set comments "VPN:Com-To-HUB Com"
        set idle-timeout enable
        set idle-timeoutinterval 5
        set auto-discovery-receiver enable
        set auto-discovery-shortcuts dependent
        set network-overlay enable
        set network-id 1
        set remote-gw 192.168.1.252
        set psksecret ENC Cx/kpobjqFhmOOqExKeLIUBKZvi4Jzz2+GoIf6VH9fefbkn+TwGRk5FLOtP1IYyhMFzNW+XF+ZgRWwwUd6uX7VXUDkHimSB07c38j2FCl6rHUTCscn/OOtX82kLf3gj2NBu+gU9fZ8jzrBtQW3DY71oPPsq+7MEdsBenhs9AO61Hwh+1VwcpvsSywQGR9t2RGgxDzg==
        set dpd-retryinterval 3
    next
end

Spoke-B-Flint (phase1-interface) # 

 

please check and help me why Spoke A ccannot talk to Spoke b if there is everything 

 

Admin-HA # get router info bgp  summary 
VRF 0 BGP router identifier 172.16.254.252, local AS number 65000
BGP table version is 4
1 BGP AS-PATH entries
0 BGP community entries
Next peer check timer due in 31 seconds

Neighbor     V         AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
172.16.254.1 4      65000     200     231        3    0    0 00:06:56        2
172.16.254.2 4      65000     100     120        2    0    0 00:06:54        2

Total number of neighbors 2

 

Admin-HA # 

 

 

 

 

 

​@msanjaypadma did you check this also going tho send you other information you request below in few minutes

 

 

 

 

M
MalamAuthor
Visitor II
June 18, 2026

i think i got it it was policy issue in ADVPN to ADVPN but another question why it going alwsy to hub? why it not going to spoke to spoke direct after some tracerote from PC when i do it go same but after few traceroute it got stuck and then go to direct to Spoke B is something i am missing in configurain 

 

msanjaypadma
Staff
msanjaypadma
Staff
June 18, 2026

Hi ​@Malam ,

can you share the below configuration from all firewall

show router bgp
show sys interface Com-ADVPN
show sys interface VER-1
dia ip address list
show router route-map

Thanks, Mayur Padma
M
MalamAuthor
Visitor II
June 18, 2026

​@msanjaypadma 

 

This is Hub ( 

Admin # 
Admin # show router bgp 
config router bgp
    set as 65000
    set router-id 172.16.254.252
    set ibgp-multipath enable
    set recursive-next-hop enable
    config neighbor-group
        edit "ADVPN"
            set advertisement-interval 1
            set soft-reconfiguration enable
            set interface "BGP-LO"
            set remote-as 65000
            set update-source "BGP-LO"
            set route-reflector-client enable
        next
    end
    config neighbor-range
        edit 1
            set prefix 172.16.254.0 255.255.255.0
            set max-neighbor-num 60
            set neighbor-group "ADVPN"
        next
    end
    config network
        edit 1
            set prefix 172.16.254.0 255.255.255.0
        next
        edit 2
            set prefix 172.31.247.0 255.255.255.0
        next
    end
    config network6
        edit 1
            set prefix6 ::/128
        next
    end
    config redistribute "connected"
    end
    config redistribute "rip"
    end
    config redistribute "ospf"
    end
    config redistribute "static"
    end
    config redistribute "isis"
    end
    config redistribute6 "connected"
    end
    config redistribute6 "rip"
    end  
    config redistribute6 "ospf"
    end
    config redistribute6 "static"
    end
    config redistribute6 "isis"
    end
end

Admin #  show system interface Com-ADVPN2 
config system interface
    edit "Com-ADVPN2"
        set vdom "root"
        set type tunnel
        set snmp-index 17
        set interface "port1"
    next
end

Admin # show system interface 
name    Name.
BGP-Health   static   0.0.0.0 0.0.0.0  172.16.254.253 255.255.255.255  up   disable   loopback  
BGP-LO   static   0.0.0.0 0.0.0.0  172.16.254.252 255.255.255.255  up   disable   loopback  
Com-ADVPN2   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   tunnel  
fortilink   static   0.0.0.0 0.0.0.0  10.255.1.1 255.255.255.0  up   disable   aggregate  
l2t.root   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   tunnel  
naf.root   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   tunnel  
port1   static   0.0.0.0 0.0.0.0  192.168.1.252 255.255.255.0  up   disable   physical  
port2   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  
port3   static   0.0.0.0 0.0.0.0  172.31.247.1 255.255.255.0  up   disable   physical  
port4   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  
port5   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  
port6   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  
port7   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  
port8   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  
port9   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  
port10   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  
ssl.root   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   tunnel  

Admin # di ip address list 
IP=192.168.1.252->192.168.1.252/255.255.255.0 index=3 devname=port1
IP=172.31.247.1->172.31.247.1/255.255.255.0 index=5 devname=port3
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=13 devname=root
IP=10.255.1.1->10.255.1.1/255.255.255.0 index=17 devname=fortilink
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=18 devname=BGP-LO
IP=172.16.254.252->172.16.254.252/255.255.255.255 index=18 devname=BGP-LO
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=19 devname=BGP-Health
IP=172.16.254.253->172.16.254.253/255.255.255.255 index=19 devname=BGP-Health
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=21 devname=vsys_ha
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=23 devname=vsys_fgfm

Admin # shor rout
command parse error before 'shor'

Admin # show router route-map 
config router route-map
end

Admin # 

=====================================================

Spoke A

 

Dent-SpokeA # show router bgp
config router bgp
    set as 65000
    set router-id 172.16.254.1
    set ibgp-multipath enable
    set recursive-next-hop enable
    set tag-resolve-mode merge
    set graceful-restart enable
    config neighbor
        edit "172.16.254.252"
            set advertisement-interval 1
            set interface "BGP-LO"
            set remote-as 65000
            set route-map-in "HUB1_TAG"
            set connect-timer 1
            set update-source "BGP-LO"
            set additional-path both
        next
    end
    config network
        edit 1
            set prefix 172.16.254.1 255.255.255.255
        next
        edit 2
            set prefix 172.31.253.0 255.255.255.0
        next
    end
    config network6
        edit 1
            set prefix6 ::/128
        next
    end
    config redistribute "connected"
    show sys interface VER-1
end
    config redistribute "rip"
    end
    config redistribute "ospf"
    end
    config redistribute "static"
    end
    config redistribute "isis"
    end
    config redistribute6 "connected"
    end
    config redistribute6 "rip"
    end
    config redistribute6 "ospf"
    end
    config redistribute6 "static"
    end  
    config redistribute6 "isis"
    end
end

Dent-SpokeA # ow sys interface Com-ADVPN
Unknown action 0

Dent-SpokeA # show sys interface VER-1
entry is not found in table

Dent-SpokeA # dia ip address list
IP=192.168.3.252->192.168.3.252/255.255.255.0 index=3 devname=port1
IP=192.168.4.252->192.168.4.252/255.255.255.0 index=4 devname=port2
IP=172.31.253.1->172.31.253.1/255.255.255.0 index=5 devname=port3
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=7 devname=root
IP=10.255.1.1->10.255.1.1/255.255.255.0 index=11 devname=fortilink
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=12 devname=BGP-LO
IP=172.16.254.1->172.16.254.1/255.255.255.255 index=12 devname=BGP-LO
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=14 devname=vsys_ha
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=16 devname=vsys_fgfm

Dent-SpokeA # show router route-map
Dent-SpokeA # 
Dent-SpokeA # show router bgp
config router bgp
    set as 65000
    set router-id 172.16.254.1
    set ibgp-multipath enable
    set recursive-next-hop enable
    set tag-resolve-mode merge
    set graceful-restart enable
    config neighbor
        edit "172.16.254.252"
            set advertisement-interval 1
            set interface "BGP-LO"
            set remote-as 65000
            set route-map-in "HUB1_TAG"
            set connect-timer 1
            set update-source "BGP-LO"
            set additional-path both
        next
    end
    config network
        edit 1
            set prefix 172.16.254.1 255.255.255.255
        next
        edit 2
            set prefix 172.31.253.0 255.255.255.0
        next
    end
    config network6
        edit 1
            set prefix6 ::/128
        next
    end
    config redistribute "connected"
    end
    config redistribute "rip"
    end
    config redistribute "ospf"
    end
    config redistribute "static"
    end
    config redistribute "isis"
    end
    config redistribute6 "connected"
    end
    config redistribute6 "rip"
    end
    config redistribute6 "ospf"
    end
    config redistribute6 "static"
    end  
    config redistribute6 "isis"
    end
end

Dent-SpokeA #  show sys interface Com-ADVPN
entry is not found in table

Dent-SpokeA #  show sys interface 
name    Name.
BGP-LO   static   0.0.0.0 0.0.0.0  172.16.254.1 255.255.255.255  up   disable   loopback  
Dent-Com-ADVPN   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   tunnel  
fortilink   static   0.0.0.0 0.0.0.0  10.255.1.1 255.255.255.0  up   disable   aggregate  
l2t.root   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   tunnel  
naf.root   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   tunnel  
port1   static   0.0.0.0 0.0.0.0  192.168.3.252 255.255.255.0  up   disable   physical  
port2   static   0.0.0.0 0.0.0.0  192.168.4.252 255.255.255.0  up   disable   physical  
port3   static   0.0.0.0 0.0.0.0  172.31.253.1 255.255.255.0  up   disable   physical  
port4   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  
ssl.root   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   tunnel  

Dent-SpokeA #  show sys interface Dent-Com-ADVPN 
config system interface
    edit "Dent-Com-ADVPN"
        set vdom "root"
        set type tunnel
        set snmp-index 10
        set interface "port1"
    next
end

Dent-SpokeA # dia ip address list
IP=192.168.3.252->192.168.3.252/255.255.255.0 index=3 devname=port1
IP=192.168.4.252->192.168.4.252/255.255.255.0 index=4 devname=port2
IP=172.31.253.1->172.31.253.1/255.255.255.0 index=5 devname=port3
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=7 devname=root
IP=10.255.1.1->10.255.1.1/255.255.255.0 index=11 devname=fortilink
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=12 devname=BGP-LO
IP=172.16.254.1->172.16.254.1/255.255.255.255 index=12 devname=BGP-LO
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=14 devname=vsys_ha
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=16 devname=vsys_fgfm

Dent-SpokeA # show router route-map
config router route-map
    edit "HUB1_TAG"
        config rule
            edit 1
                set set-tag 1
            next
        end
    next
end

 

========================================================

Spoke B

Flint-SpokeB # 
Flint-SpokeB # show router bgp 
config router bgp
    set as 65000
    set router-id 172.16.254.2
    set ibgp-multipath enable
    set recursive-next-hop enable
    set tag-resolve-mode merge
    set graceful-restart enable
    config neighbor
        edit "172.16.254.252"
            set advertisement-interval 1
            set interface "BGP-LO"
            set remote-as 65000
            set route-map-in "HUB1_TAG"
            set connect-timer 1
            set update-source "BGP-LO"
            set additional-path both
        next
    end
    config network
        edit 1
            set prefix 172.16.254.2 255.255.255.255
        next
        edit 2
            set prefix 172.31.220.0 255.255.255.0
        next
    end
    config network6
        edit 1
            set prefix6 ::/128
        next
    end
    config redistribute "connected"
    end
    config redistribute "rip"
    end
    config redistribute "ospf"
    end
    config redistribute "static"
    end
    config redistribute "isis"
    end
    config redistribute6 "connected"
    end
    config redistribute6 "rip"
    end
    config redistribute6 "ospf"
    end
    config redistribute6 "static"
    end  
    config redistribute6 "isis"
    end
end

Flint-SpokeB # show system interface 
name    Name.
BGP-LO   static   0.0.0.0 0.0.0.0  172.16.254.2 255.255.255.255  up   disable   loopback  
Flint-Com-ADVPN   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   tunnel  
fortilink   static   0.0.0.0 0.0.0.0  10.255.1.1 255.255.255.0  up   disable   aggregate  
l2t.root   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   tunnel  
naf.root   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   tunnel  
port1   static   0.0.0.0 0.0.0.0  192.168.5.252 255.255.255.0  up   disable   physical  
port2   static   0.0.0.0 0.0.0.0  192.168.6.252 255.255.255.0  up   disable   physical  
port3   static   0.0.0.0 0.0.0.0  172.31.220.1 255.255.255.0  up   disable   physical  
port4   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  
port5   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  
port6   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  
port7   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  
port8   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   physical  
ssl.root   static   0.0.0.0 0.0.0.0  0.0.0.0 0.0.0.0  up   disable   tunnel  

Flint-SpokeB # show system interface Flint-Com-ADVPN 
config system interface
    edit "Flint-Com-ADVPN"
        set vdom "root"
        set type tunnel
        set snmp-index 14
        set interface "port1"
    next
end

Flint-SpokeB # dia ip address list 
IP=192.168.5.252->192.168.5.252/255.255.255.0 index=3 devname=port1
IP=192.168.6.252->192.168.6.252/255.255.255.0 index=4 devname=port2
IP=172.31.220.1->172.31.220.1/255.255.255.0 index=5 devname=port3
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=11 devname=root
IP=10.255.1.1->10.255.1.1/255.255.255.0 index=15 devname=fortilink
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=16 devname=BGP-LO
IP=172.16.254.2->172.16.254.2/255.255.255.255 index=16 devname=BGP-LO
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=18 devname=vsys_ha
IP=127.0.0.1->127.0.0.1/255.0.0.0 index=20 devname=vsys_fgfm

Flint-SpokeB # show router route-map 
config router route-map
    edit "HUB1_TAG"
        config rule
            edit 1
                set set-tag 1
            next
        end
    next
end

Flint-SpokeB # 

 

 

 

msanjaypadma
Staff
msanjaypadma
Staff
June 19, 2026

Hi ​@Malam ,

BGP configuration seems to be fine. I see that tunnel name is different that what previously shared routing information. Thats means again you have made some changes with tunnel or reconfigured.
Can you share the complete all 3 backup config file and exe tac report, I will reverify it. There is an option to attach file.

Thanks, Mayur Padma
Terms & ConditionsAccessibility statement