Technical Tip: Configuring ADVPN and analyzing logs

Samiksha · ‎11-30-2021

Description

This article describes how to configure ADVPN setup and what logs are observed for spoke-to-spoke dynamic tunnel negotiation.

Scope

Solution

The FortiGate feature ADVPN can be set up to establish direct tunnels negotiated dynamically between two spokes in a hub and spoke architecture.

The setup for this example is as follows:

Hub --------> Spoke 1, Hub --------> Spoke 2

After enabling ADVPN the setup will look like:

Hub --------> Spoke 1, Hub --------> Spoke 2 and Spoke 1 ------> Spoke 2

Here is the Step-by-Step guide on how to configure ADVPN:

On Hub the configuration will look like.

- IPsec phase1-interface and phase2-interface config:

# config vpn ipsec phase1-interface

edit "advpn-hub"

set type dynamic

set interface "port4" –--- WAN Port

set peertype any

set net-device disable

set proposal aes128-sha256 aes256-sha256 3des-sha256 aes128-sha1 aes256-sha1 3des-sha1

set add-route disable

set dpd on-idle

set auto-discovery-sender enable ----- Enable ADVPN on Hub

set psksecret password

set dpd-retryinterval 5

# config vpn ipsec phase2-interface

edit "advpn-hub"

set phase1name "advpn-hub"

set proposal aes128-sha1 aes256-sha1 3des-sha1 aes128-sha256 aes256-sha256 3des-sha256

- IPsec tunnel interface IP address.

edit "advpn-hub"

set vdom "root"

set ip 10.10.10.254 255.255.255.255

set type tunnel

set remote-ip 10.10.10.253 255.255.255.0

set snmp-index 15

set interface "port4"

- Hub BGP configuration.

# config router bgp

set as 65412

# config neighbor-group

edit "advpn"

set link-down-failover enable

set remote-as 65412

set route-reflector-client enable ----- Making Hub as BGP RR

edit 1

set prefix 10.10.10.0 255.255.255.0

set neighbor-group "advpn"

edit 1

set prefix 10.100.0.0 255.255.240.0 <----- Hub Lan Subnet.

- IPsec phase1-interface and phase2-interface config:

# config vpn ipsec phase1-interface

edit "spoke1"

set interface "port5" –--- WAN Port

set peertype any

set net-device enable

set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256sha1

set dpd on-idle

set auto-discovery-receiver enable <----- Enable ADVPN on Spoke.

set remote-gw 10.40.51.214

set psksecret password

set dpd-retryinterval 5

# config vpn ipsec phase2-interface

edit "spoke1"

set phase1name "spoke1"

set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305

set auto-negotiate enable

- IPsec tunnel interface IP address.

edit "spoke1"

set vdom "root"

set ip 10.10.10.1 255.255.255.255

set type tunnel

set remote-ip 10.10.10.254 255.255.255.0 <-–--- Hub Tunnel IP.

set snmp-index 13

set interface "port5"

- Spoke 1 BGP configuration.

# config router bgp

set as 65412

# config neighbor

edit "10.10.10.254"

set advertisement-interval 1

set link-down-failover enable

set remote-as 65412

# config network

edit 1

set prefix 10.103.0.0 255.255.240.0 <----- Spoke 1 Lan Subnet.

- IPsec phase1-interface and phase2-interface config:

# config vpn ipsec phase1-interface

edit "spoke2"

set interface "port1" <-–--- WAN Port.

set peertype any

set net-device enable

set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha

set dpd on-idle

set auto-discovery-receiver enable <----- Enable ADVPN on Spoke.

set remote-gw 10.40.51.214

set psksecret password

set dpd-retryinterval 5

# config vpn ipsec phase2-interface

edit "spoke2"

set phase1name "spoke2"

set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20poly1305

set auto-negotiate enable

- IPsec tunnel interface IP address.

edit "spoke2"

set vdom "root"

set ip 10.10.10.3 255.255.255.255

set type tunnel

set remote-ip 10.10.10.254 255.255.255.0 <----- Hub Tunnel IP.

set snmp-index 13

set interface "port1"

- Spoke 2 BGP configuration.

# config router bgp

set as 65412

# config neighbor

edit "10.10.10.254"

set advertisement-interval 1

set link-down-failover enable

set remote-as 65412

# config network

edit 1

set prefix 10.104.0.0 255.255.240.0 <----- Spoke 2 Lan. Subnet

- When net-device is disabled, all dialup tunnels share an interface on the hub.

- When net-device is enabled, dynamic interfaces are created on the hub for each dialup tunnel.

Run diagnose commands to check VPN and BGP status:

BGP Table on HUB:

Hub # get router info routing-table bgp

Routing table for VRF=0

B 10.103.0.0/20 [200/0] via 10.10.10.1 (recursive via advpn-hub tunnel 10.10.10.1), 2d21h59m

B 10.104.0.0/20 [200/0] via 10.10.10.3 (recursive via advpn-hub tunnel 10.10.10.3), 2d21h59m

BGP Table on Spoke1:

Spoke1 # get router info routing-table bgp

Routing table for VRF=0

B 10.100.0.0/20 [200/0] via 10.10.10.254, spoke1, 2d22h00m

B 10.104.0.0/20 [200/0] via 10.10.10.3, spoke1, 1d21h58m

BGP Table on Spoke2:

Spoke2 # get router info routing-table bgp

Routing table for VRF=0

B 10.100.0.0/20 [200/0] via 10.10.10.254, spoke2, 2d22h00m

B 10.103.0.0/20 [200/0] via 10.10.10.1, spoke2, 1d21h59m

VPN Table on HUB:

Hub # diagnose vpn tunnel list

list all ipsec tunnel in vd 0

---Tunnel with Spoke 2

name=advpn-hub_0 ver=1 serial=8 10.40.51.214:0->10.40.51.197:0 tun_id=10.10.10.3 dst_mtu=1500 dpd-link=on remote_location=0.0.0.0 weight=1

---Tunnel with Spoke 1.

name=advpn-hub_1 ver=1 serial=9 10.40.51.214:0->10.40.51.216:0 tun_id=10.10.10.1 dst_mtu=1500 dpd-link=on remote_location=0.0.0.0 weight=1

VPN Table on Spoke1:

Spoke1 # diagnose vpn tunnel list

---Tunnel with Hub.

list all ipsec tunnel in vd 0

------------------------------------------------------

name=spoke1 ver=1 serial=1 10.40.51.216:0->10.40.51.214:0 dst_mtu=1500

VPN Table on Spoke2:

Spoke2 # diagnose vpn tunnel list

---Tunnel with Hub.

list all ipsec tunnel in vd 0

------------------------------------------------------

name=spoke2 ver=1 serial=1 10.40.51.197:0->10.40.51.214:0 dst_mtu=1500

After initiating ping traffic from Spoke 1 Lan Subnet to Spoke 2 Lan Subnet it triggers the formation of a shortcut tunnel between them.

Below are the ADVPN sequence of events that dictate how the Shortcut Tunnel negotiation takes place between Spoke 1 and Spoke 2:

1) Hub sends Shortcut Offer to Spoke 1.

ike 0: shortcut advpn-hub_1:10.40.51.216:0 to advpn-hub_0:10.40.51.197:0 for 10.103.3.216->10.104.3.197

ike 0 send shortcut-offer to advpn-hub_1

ike 0:advpn-hub_1:8: enc

ike 0:advpn-hub_1:8: sent IKE msg (SHORTCUT-OFFER): 10.40.51.214:500-10.40.51.216:500, len=220, vrf=0, id=012787d430278d8f/ae21a26df2ad43b7:e4100629 <-------

2) Spoke 1 receives Shortcut Offer from the HUB.

ike 0:spoke1:9: notify msg received: SHORTCUT-OFFER <--------

ike 0:spoke1: shortcut-offer 10.103.3.216->10.104.3.197 psk 64 ppk 0 ver 1 mode 0, peer-addr 10.40.51.197:500

ike 0 looking up shortcut by addr 10.104.3.197, name spoke1, peer-addr 10.40.51.197:500

3) Spoke 1 sends Shortcut Query to the HUB.

ike 0:spoke1: send shortcut-query 18174035847785826865 44c39945fa7ec251/0000000000000000 10.40.51.216 10.103.3.216->10.104.3.197 psk 64 ttl 32 nat 0 ver 1 mode 0

ike 0:spoke1:9: sent IKE msg (SHORTCUT-QUERY): 10.40.51.216:500->10.40.51.214:500, len=236, <--------

id=012787d430278d8f/ae21a26df2ad43b7:9f3f828c

4) HUB receives Shortcut Query from Spoke 1.

ike 0:advpn-hub_1:8: notify msg received: SHORTCUT-QUERY <-------

ike 0:advpn-hub_1: recv shortcut-query 18174035847785826865 44c39945fa7ec251/0000000000000000 10.40.51.216 10.103.3.216->10.104.3.197 psk 64 ppk 0 ttl 32 nat 0 ver 1 mode 0

ike 0:advpn-hub: iif 21 10.103.3.216->10.104.3.197 route lookup oif 21 advpn-hub gwy 10.10.10.3

5) HUB forwards Shortcut Query to Spoke 2.

ike 0:advpn-hub_0: forward shortcut-query 18174035847785826865 44c39945fa7ec251/0000000000000000 10.40.51.216 10.103.3.216->10.104.3.197 psk 64 ppk 0 ttl 31 ver 1 mode 0, ext-mapping 10.40.51.197:500

ike 0:advpn-hub_0:9: enc

ike 0:advpn-hub_0:9: sent IKE msg (SHORTCUT-QUERY): 10.40.51.214:500->10.40.51.197:500, len=236, vrf=0, <--------

id=e82803871055e57c/4cd9f6960772b271:fe1a6904

6) Spoke 2 receives Shortcut Query forwarded by HUB.

ike 0:spoke2:12: notify msg received: SHORTCUT-QUERY <--------

ike 0:spoke2: recv shortcut-query 18174035847785826865 44c39945fa7ec251/0000000000000000 10.40.51.216 10.103.3.216->10.104.3.197 psk 64 ppk 0 ttl 31 nat 0 ver 1 mode 0

ike 0:spoke2: iif 19 10.103.3.216->10.104.3.197 route lookup oif 13 root

ike 0:spoke2: shortcut-query received from 10.40.51.197:500, local-nat=no, peer-nat=no

6) Spoke 2 sends Shortcut Reply to the HUB.

ike 0:spoke2: send shortcut-reply 18174035847785826865 44c39945fa7ec251/43b7cdace2605404 10.40.51.197 to 10.103.3.216 psk 64 ppk 0 ver 1 mode 0

ike 0:spoke2:12: sent IKE msg (SHORTCUT-REPLY): 10.40.51.197:500->10.40.51.214:500, len=220, <--------id=e82803871055e57c/4cd9f6960772b271:3224b45c

7) HUB forwards Shortcut Reply to Spoke 1.

ike 0:advpn-hub_0:9: notify msg received: SHORTCUT-REPLY

ike 0:advpn-hub_0: recv shortcut-reply 18174035847785826865 44c39945fa7ec251/43b7cdace2605404 10.40.51.197 to 10.103.3.216 psk 64 ppk 0 ver 1 mode 0 ext-mapping 0.0.0.0:0

ike 0:advpn-hub_1: forward shortcut-reply 18174035847785826865 44c39945fa7ec251/43b7cdace2605404 10.40.51.197 to 10.103.3.216 psk 64 ppk 0 ttl 31 ver 1 mode 0 ext-mapping 10.40.51.197:500

ike 0:advpn-hub_1:8: sent IKE msg (SHORTCUT-REPLY): 10.40.51.214:500->10.40.51.216:500, len=236, vrf=0, <--------

id=012787d430278d8f/ae21a26df2ad43b7:d8bda5c9

8) Spoke 1 receives Shortcut Reply from HUB.

ike 0:spoke1:9: notify msg received: SHORTCUT-REPLY <--------

ike 0:spoke1: recv shortcut-reply 18174035847785826865 44c39945fa7ec251/43b7cdace2605404 10.40.51.197 to 10.103.3.216 psk 64 ppk 0 ver 1 mode 0 ext-mapping 10.40.51.197:500

ike 0:spoke1: iif 19 10.104.3.197->10.103.3.216 route lookup oif 13 root

ike 0:spoke1: shortcut-reply received from 10.40.51.197:500, local-nat=no, peer-nat=no

9) Spoke 1 then starts the negotiation of a shortcut/direct tunnel with Spoke 2.

ike 0:spoke1: created connection: 0xca63f00 7 10.40.51.216->10.40.51.197:500.

ike 0:spoke1: adding new dynamic tunnel for 10.40.51.197:500

ike 0:spoke1_0: added new dynamic tunnel for 10.40.51.197:500

ike 0:spoke1_0: shortcut selector added, new serial 1

ike 0:spoke1_0:10: initiator: main mode is sending 1st message...

VPN Table on Spoke1:

Spoke1 # diagnose vpn tunnel list

---Tunnel with Hub.

list all ipsec tunnel in vd 0

------------------------------------------------------

name=spoke1 ver=1 serial=1 10.40.51.216:0->10.40.51.214:0 dst_mtu=150

---Tunnel with Spoke 2.

list all ipsec tunnel in vd 0

------------------------------------------------------

name=spoke1_0 ver=1 serial=1 10.40.51.216:0->10.40.51.197:0 dst_mtu=1500

VPN Table on Spoke2:

Spoke2 # diagnose vpn tunnel list

---Tunnel with Hub.

list all ipsec tunnel in vd 0

------------------------------------------------------

name=spoke2 ver=1 serial=1 10.40.51.197:0->10.40.51.214:0 dst_mtu=1500

---Tunnel with Spoke 1.

list all ipsec tunnel in vd 0

------------------------------------------------------

name=spoke2_0 ver=1 serial=1 10.40.51.197:0->10.40.51.216:0 dst_mtu=1500