FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
bvagadia
Staff
Staff
Article Id 199348
Description This article describes how to take debug in ADVPN when the shortcuts between Spokes are not established, despite the tunnel being up.
Scope FortiOS.
Solution

If the connectivity between Hub and Spoke is fine, take the IKE debugs to further analyze the details for the ADVPN shortcut.

 

Take the debug on spoke to collect the shortcut negotiation:

 

FGT SDW 1 # diagnose debug reset
FGT SDW 1 # diagnose vpn ike log-filter clear
FGT SDW 1 # diagnose vpn ike log-filter mdst-addr4 x.x.x.x y.y.y.y
FGT SDW 1 # diagnose debug application ike -1
FGT SDW 1 # diagnose debug console timestamp enable
FGT SDW 1 # diagnose debug enable


Starting from FortiOS 7.4.1, the log filter commands have been changed to (Refer: Troubleshooting Tip: IPSEC Tunnel (debugging IKE)).

 

diagnose vpn ike log filter mrem-addr4 x.x.x.x y.y.y.y

 

The above IKE debug on Spoke-1 is filtered for multiple IP addresses (mdst-addr4):

  • ISP1 IP address of the Hub (x.x.x.x).
  • ISP1 IP address of Spoke-2 (y.y.y.y).

 

It allows capturing the shortcut negotiation between Spoke1↔Hub as well as the shortcut tunnel establishment between Spoke-1↔Spoke-2.

Now trigger the shortcut by sending traffic from the Spoke-1 source to the Spoke-2 destination.

 

Wait for 15 seconds and then stop debug with the help of the below command:

 

diagnose debug reset