|
If the connectivity between Hub and Spoke is fine, take the IKE debugs to further analyze the details for the ADVPN shortcut.
Take the debug on spoke to collect the shortcut negotiation
FGT SDW 1 # diagnose debug reset
FGT SDW 1 # diagnose vpn ike log filter clear
FGT SDW 1 # diagnose vpn ike log filter mdst addr4 x.x.x.x y.y.y.y
FGT SDW 1 # diagnose debug application ike -1
FGT SDW 1 # diagnose debug console timestamp enable
FGT SDW 1 # diagnose debug enable
The above IKE debug on Spoke-1 is filtered for multiple IP addresses (mdst-addr4):
- ISP1 IP address of the Hub (x.x.x.x).
- ISP1 IP address of Spoke-2 (y.y.y.y).
It allows capturing the shortcut negotiation between Spoke1↔Hub as well as the shortcut tunnel establishment between Spoke-1↔Spoke-2
Now trigger the shortcut by sending traffic from Spoke-1 source to Spoke-2 destination
Wait for 15 seconds and then stop debug with the help of the below command.
# diagnose debug reset
|
