Technical Tip: Configuring Dynamic BGP for ADVPN 2.0

Nivedha · ‎09-02-2025

Description

This article describes how to configure Dynamic BGP for ADVPN 2.0.

Scope

FortiGate v7.4.2+.

Solution

ADVPN 2.0 is an enhancement of ADVPN 1.0. In ADVPN 1.0, the spokes select the shortcut path by using an overlay between the spokes. In ADVPN 2.0, the spokes select the shortcut path via edge discovery and path management functionality.

To implement Dynamic BGP peering, please ensure these points are addressed:

All Spokes should have LAN subnets placed serially. If not, Hub has to advertise all private IP subnets on BGP.
No route reflection is enabled on the hub
BGP peering between spokes is on-demand and shortcut-triggered
Spokes learn only relevant routes from direct BGP peers

Hub configuration:
The route reflection is not enabled on the Hub, and the Hub is advertising 192.168.0.0/16, which is the LAN summary of all spokes.

BGP settings:

Hub1 # show router bgp
config router bgp
set as 65400
set ibgp-multipath enable
set additional-path enable
set additional-path-select 3
config neighbor-group
edit "PrimarySpoke"
set soft-reconfiguration enable
set remote-as 65400
set route-map-in "test"
set additional-path both
next
edit "SecondarySpoke"
set soft-reconfiguration enable
set remote-as 65400
set additional-path both
next
end
config neighbor-range
edit 1
set prefix 10.250.255.0 255.255.255.0
set neighbor-group "PrimarySpoke"
next
edit 2
set prefix 10.254.255.0 255.255.255.0
set neighbor-group "SecondarySpoke"
next
end
config network
edit 1
set prefix 192.168.1.0 255.255.255.0
next
edit 2
set prefix 192.167.1.1 255.255.255.255
next
edit 3
set prefix 192.168.0.0 255.255.0.0
set network-import-check disable
next
end
end

Spoke configuration:
The spoke devices will have 'set passive disable' added to the config, as spoke needs to initiate neighborship with another spoke after the shortcut is created.

BGP configuration: