HI,
Would like to know does FGT sdwan support configure auto-discovery-receiver and auto-discovery-sender in same devices (Region)? Let me share some background here, i would like configure 3 tier SDWAN connection like below. may i know is it feasible to configure ADVPN "auto-discovery-receiver" in "Region device" as a spoke device talk to Hub (HQ), as well as configure ADVPN "auto-discovery-sender" as a hub for (Branch) spoke ?
Hub (HQ) <------ Spoke (Region) /Hub <------- spoke (Branch)
Thanks
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello, kindly see the below link for detailed information:
Hi,
Yes, you can have both auto-discovery-receiver and auto-discovery-sender enabled in the same device with SD-WAN configured.
Here are some considerations and insights regarding the setup and requirements:
In essence, your network structure involves a central Hub at the Headquarters (HQ), overseeing multiple Regions. Each Region, in turn, acts as a hub for its respective branches. The goal here is to establish seamless communication: Regions forming shortcut tunnels with other Regions linked to the HQ-Hub, and branches creating shortcut tunnels with other branches connected to the same Region-Hub.
Achieving the desired setup encounters a challenge when attempting to establish a single tunnel on the Region-Hub side. The reason is rooted in the configuration disparity between the Hub and the spokes: the Hub utilizes Dial-Up tunnels, while the spokes rely on Static tunnels. The initiation of VPN tunnels consistently originates from the spoke end due to the Hub's lack of knowledge about the VPN gateway addresses of the spokes.
In light of this, the Region-HUB is configured with a Dial-Up tunnel (for branches to connect) and the HQ-HUB with another Dial-Up tunnel (for regions to connect). However, these two Dial-Up tunnels—one from the HQ-HUB and the other from the Region-HUB—cannot directly communicate or form a tunnel between them. To address this, specific configurations are needed on the Hubs.
So, that the communication between the Region-HUBs can flow via shortcuts between them. At the same time, the communication between the branches from the same location can flow via the shortcuts formed between them. Now if the communication between the branch from different regions, would flow via the shortcuts between the Region-HUBs.
If you require, shortcuts to be formed between the branches of different regions, then additional configuration is required.
Cheers,
HI @rarumugam ,
It's quit useful for the information. May i know is it a standard way to achieve above design as i don't see any Fortinet document have related information. Just found out Multi region sample without any sample configuration/parameter from fortinet document.
Regarding the additional configuration for shortcuts to be formed between the branches of different regions, could share it out the sample or parameter?
Thanks
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1705 | |
1093 | |
752 | |
446 | |
230 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.