Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor II

Hub-Spoke With Redundant Tunnels

I am working on designing a solution that requires a 'spoke' network to communicate with other 'spoke' networks without the other spoke networks being able to communicate with each other.

There is a remote operations center, 2 datacenters (these will be hubs), and then 60+ remote networks.  The ROC needs to communicate with every remote site.  The remote sites all need to communicate with the datacenters and possibly an additional remote site (ie spoke) with strict source/destination and services rules.  These will also need to communicate via primary and secondary ISP connections.

I am looking at the ADVPN/BGP solution from Fortigate documentation, but it appears there might be a couple ways to do this and am not sure what the best method is.  What would be the case for OSPF vs BGP?



Hi JGaiser,


Fortinet recommend iBGP instead of OSPF. Here are some links that might be helpful. I believe the first one is the most appropriate for your case. 

New Contributor II

This isn't quite getting me to where I need.

I have a lab network with 4 firewalls.  1 is a hub, 3 are spokes.

I have used the Wizard to setup hub and spoke setup between the 4 devices per this documentation: IPsec VPN wizard hub-and-spoke ADVPN support | FortiGate / FortiOS 6.2.0 | Fortinet Document Library

All of the tunnels are showing as up, however these problems remain:

-No traffic is flowing between the spokes and the hub at all.  I would only like 2 of the spokes to be able to communicate with each other and the hub, while the 3rd spoke should only communicate with the hub.  What additional settings that are not in the documentation need to be configured to allow this to happen?

-I am not able to find a way to configure SD-WAN as the outgoing interface on the spokes.  The hub has 1 ISP connection.  All of the spokes have 2.  The test needs to conclude that the hub-and-spoke connections are able to use SD-WAN for high-availability.

New Contributor II

It looks like the lab hub is not advertising routes to the lab spokes.  After following the wizard setup as mentioned above, what could be causing the routes not to be advertised?

Top Kudoed Authors