Technical Tip: ADVPN shortcut tunnels has multiple IPs which breaks the communication between spokes

aruns · ‎06-29-2022

Description

This article describes the reason why sometimes ADVPN shortcut tunnels will be up, but communication fails between them.

Scope

ADVPN with Mode-cfg + BGP Routing.

Solution

Explanation:

ADVPN tunnel IP address should be same for the main ADVPN tunnel & Shortcut tunnels, if the IP addresses are different, then the communication to that spoke will break.

Run the command 'diag ip address list'

# diag ip address list

IP=10.254.0.85->10.254.0.85/255.255.252.0 index=36 devname=ADVPN_PRI

IP=10.254.0.79->10.254.0.49/255.255.255.255 index=89 devname=ADVPN_PRI_0

IP=10.254.0.85->10.254.0.49/255.255.255.255 index=108 devname=ADVPN_PRI_1

In the above output, the ADVPN_PRI & ADVPN_PRI_1 has 10.254.0.85, but the ADVPN_PRI_0 has 10.254.0.79.

The BGP Route shows as below:

# get router info routing-table details 10.120.130.0/18

Routing table for VRF=0

Routing entry for 10.120.130.0/18

Known via "bgp", distance 200, metric 0, best

Last update 00:06:17 ago

* 10.254.0.49, via ADVPN_PRI_0 distance 0 <<<<<<<<<<<<<<-------------- shows via 'ADVPN_PRI_0', instead it should be 'ADVPN_PRI_1'

Solution:

set 'auto-discovery-shortcuts dependent' on all the spokes.

auto-discovery-shortcuts:- Control deletion of child short-cut tunnels when the parent tunnel goes down.

independent (Default) - Short-cut tunnels remain up if the parent tunnel goes down.

dependent - Short-cut tunnels are brought down if the parent tunnel goes down.

So, when the Primary tunnel goes down for some reason, comes back with a different IP assigned by mode-cfg to the Spoke Device VPN tunnel, 'dependent' option helps to delete the short-cut tunnels, when the parent tunnel goes down.

In FortiOS 7.2.0 'dependent' is the Default Option.

Note:

As of FortiOS 7.0.8 and 7.2.0, 'auto-discovery-shortcuts independent' cannot be set on an IPsec tunnel when 'set mode-config enable' is also set. This is because mode-config uses the hub FortiGate to assign dynamic IP addresses to spoke FortiGates. If a spoke were to receive a different tunnel overlay IP address from the hub FortiGate after reconnecting to the hub, then any existing shortcut tunnels would break.