FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Article Id 288940

This article describes how to resolve an issue where an ADVPN shortcut tunnel performance SLA in SD-WAN shows the link is down and it cannot be pinged.

Scope FortiGate.

SD-WAN Overlay Design - ADVPN Configuration:


  1. SDWAN in configured with ADVPN interfaces. 
  2. Spoke is configured to monitor the loopback interface of the Hub (Ex.
  3. Spoke health check to hub is working fine.
  4. When ADVPN connection established, ADVPN came up and the respective (shortcut) will become a sub-member in the performance SLA configuration.
  5. The health check is performed using a ping protocol to the loopback interface as a probing server. The ping never succeeds for the shortcut tunnel.

shortcut down.PNG


advpn health check.PNG


  1.  If the ADVPN setup was implemented using the wizard, the ping service may not have been enabled on the tunnel interface level.
  2. The interface must be allowed to respond to ping packets.
  3. The reason for this is that SD-WAN sends probes to the overlay IP address of the remote spoke to monitor the shortcut performance and health.

    In this example, is the overlay IP address of the remote spoke:


sniffer on shortcut tunnel.PNG


  1. For this reason, if ping access is not enabled, ping probes fail and the shortcuts are marked as dead.
  2. Enable an administrative access ping on the ADVPN tunnel interface of spokes.

Through the CLI:


config system interface

edit "<tunnel.interface>" 

set allowaccess ping