Troubleshooting Tip: ADVPN shortcut tunnel performance SLA shows the link is down

[SassiVeeran]

Description	This article describes how to resolve an issue where an ADVPN shortcut tunnel performance SLA in SD-WAN shows the link is down and it cannot be pinged.
Scope	FortiGate.
Solution	SD-WAN Overlay Design - ADVPN Configuration: SDWAN in configured with ADVPN interfaces.  Spoke is configured to monitor the loopback interface of the Hub (Ex. 10.0.0.2). Spoke health check to hub is working fine. When ADVPN connection established, ADVPN came up and the respective (shortcut) will become a sub-member in the performance SLA configuration. The health check is performed using a ping protocol to the loopback interface as a probing server. The ping never succeeds for the shortcut tunnel.  If the ADVPN setup was implemented using the wizard, the ping service may not have been enabled on the tunnel interface level. The interface must be allowed to respond to ping packets. The reason for this is that SD-WAN sends probes to the overlay IP address of the remote spoke to monitor the shortcut performance and health. In this example, 10.10.1.3 is the overlay IP address of the remote spoke: For this reason, if ping access is not enabled, ping probes fail and the shortcuts are marked as dead. Enable an administrative access ping on the ADVPN tunnel interface of spokes. Through the CLI: config system interface edit "<tunnel.interface>"  set allowaccess ping end If performance SLA still shows as down after enabling the ping on the tunnel interface, make sure ping is enabled on the spokes on both ends which are creating shortcut tunnels.