Technical Tip: Implement Hub and Spoke ADVPN – using IPsec wizard

[iskandar_lie]

Description	This article describes how to implement Hub and Spoke ADVPN – using IPSec wizard.
Scope	FortiGate v. 7.2.1 Scenario: HUB and Spoke IPSec topology. Spoke client must be able to communicate with another spoke client directly when an on-demand tunnel is created (ADVPN feature). BGP is the overlay routing protocol.
Solution	Diagram: Note: FortiGate Hub and Spoke IPSec Wizard is using BGP as overlay protocol and ADVPN feature: Routing protocol - BGP . Firewall Policy. IPSec interface address. Address object. Let's start witthe h HUB node: The incoming interface is the outgoing physical interface for the IPSec interface. Tunnel IP is our IPSec interface address ( 10.10.10.1 ) Remote IP/Netmask – is a dummy ip address within the same subnet (10.10.10.254/24) Local AS – can be anything, refer to BGP routing protocol (in this case use private AS 65000 and IBGP configuration). Local Interface – is an interface where local subnet is connected. Local subnet is meant to be able to communicate via BGP protocol. Spoke type can be 'range' or 'individual' For range – refer to https://docs.fortinet.com/document/fortigate/6.0.0/handbook/190962/bgp. In this case individual is used, where spokeA – 10.10.10.2 and spokeB – 10.10.10.3 are defined. This is the last step of creating HUB IPsec. Copy configuration key available for Spoke #1 – SpokeA and Spoke #2 – SpokeB  Copy configuration key on notepad. Let's start creating the IPSec on SpokeA. Paste the configuration key that was copied in last step of HUB config, on 'easy configuration key' and select apply.  Remote IP Address -- IP address of HUB (192.168.12.2)  Outgoing interface -- is underlay physical interface for this IPSec (port6) Pre-shared key -- fill out with the same Pre-shared key as HUB. Tunnel IP is IPSec interface address ( 10.10.10.2 ) Remote IP/Netmask – is HUB tunnel ip address. ( 10.10.10.1 ) Local Interface – is an interface where local subnet is connected. This local subnet is meant to be able to communicate via BGP protocol. Local subnet is meant to be able to communicate via BGP protocol. Last step of SpokeA configuration. Since the configuration step on SpokeB will be similar to SpokeA – follow the same step as SpokeA. On on-demand tunnel is created whenever the traffic is initiated – when there is no traffic for some period of time, this on demand tunnel will be torn down. Conclusion: This wizard is suitable for new implementation with 2 spokes and 1 hub. This wizard is also suitable for a beginner; it will do everything required to create a Hub and Spoke ADVPN, together with the BGP routing protocol and firewall policy.   Note: The attached files are the config created by this IPSec wizard, and 'routing and IPSec information'. Related article: Technical Tip: ADVPN Spoke to Spoke traffic when HUB is down