|
Explanation:
ADVPN tunnel IP address should be same for the main ADVPN tunnel & Shortcut tunnels, if the IP addresses are different, then the communication to that spoke will break.
Run the command 'diagnose ip address list'.
diagnose ip address list
IP=10.254.0.85->10.254.0.85/255.255.252.0 index=36 devname=ADVPN_PRI
IP=10.254.0.79->10.254.0.49/255.255.255.255 index=89 devname=ADVPN_PRI_0
IP=10.254.0.85->10.254.0.49/255.255.255.255 index=108 devname=ADVPN_PRI_1
In the above output, the ADVPN_PRI & ADVPN_PRI_1 has 10.254.0.85, but the ADVPN_PRI_0 has 10.254.0.49.
The BGP Route is shown below:
get router info routing-table details 10.120.130.0/18
Routing table for VRF=0
Routing entry for 10.120.130.0/18
Known via "bgp", distance 200, metric 0, best
Last update 00:06:17 ago
* 10.254.0.49, via ADVPN_PRI_0 distance 0 <-------- Shows via 'ADVPN_PRI_0', instead it should be 'ADVPN_PRI_1'.
* 10.254.0.49, via ADVPN_PRI_0 distance 0 <---------- Shows via 'ADVPN_PRI_0', instead it should be 'ADVPN_PRI_1'.
Solution:
set 'auto-discovery-shortcuts dependent' on all the spokes.
auto-discovery-shortcuts: Control deletion of child shortcut tunnels when the parent tunnel goes down.
independent (Default): Shortcut tunnels remain up if the parent tunnel goes down.
dependent: Shortcut tunnels are brought down if the parent tunnel goes down.
So, when the Primary tunnel goes down for some reason, it comes back with a different IP assigned by mode-cfg to the Spoke Device VPN tunnel. The 'dependent' option helps to delete the short-cut tunnels when the parent tunnel goes down.
In FortiOS v7.2.0, 'dependent' is the Default Option.
Note:
As of FortiOS v7.0.8 and v7.2.0, 'auto-discovery-shortcuts independent' cannot be set on an IPsec tunnel when 'set mode-config enable' is also set. This is because mode-config uses the hub FortiGate to assign dynamic IP addresses to spoke FortiGates. If a spoke were to receive a different tunnel overlay IP address from the hub FortiGate after reconnecting to the hub, then any existing shortcut tunnels would break.
|
