FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Article Id 199348
Description This article describes how to take debug in ADVPN when the shortcuts between Spokes do not establish, despite the tunnel being up.
Scope FortiOS

If the connectivity between Hub and Spoke is fine, take the IKE debugs to further analyze the details for the ADVPN shortcut.


Take the debug on spoke to collect the shortcut negotiation


FGT SDW 1 # diagnose debug reset
FGT SDW 1 # diagnose vpn ike log filter clear
FGT SDW 1 # diagnose vpn ike log filter mdst-addr4 x.x.x.x y.y.y.y
FGT SDW 1 # diagnose debug application ike -1
FGT SDW 1 # diagnose debug console timestamp enable
FGT SDW 1 # diagnose debug enable


The above IKE debug on Spoke-1 is filtered for multiple IP addresses (mdst-addr4):

  • ISP1 IP address of the Hub (x.x.x.x).
  • ISP1 IP address of Spoke-2 (y.y.y.y).


It allows capturing the shortcut negotiation between Spoke1↔Hub as well as the shortcut tunnel establishment between Spoke-1↔Spoke-2.

Now trigger the shortcut by sending traffic from the Spoke-1 source to the Spoke-2 destination 


Wait for 15 seconds and then stop debug with the help of the below command:


diagnose debug reset