Hub-Spoke With Redundant Tunnels

JGaiser · ‎04-17-2024

I am working on designing a solution that requires a 'spoke' network to communicate with other 'spoke' networks without the other spoke networks being able to communicate with each other.

There is a remote operations center, 2 datacenters (these will be hubs), and then 60+ remote networks. The ROC needs to communicate with every remote site. The remote sites all need to communicate with the datacenters and possibly an additional remote site (ie spoke) with strict source/destination and services rules. These will also need to communicate via primary and secondary ISP connections.

I am looking at the ADVPN/BGP solution from Fortigate documentation, but it appears there might be a couple ways to do this and am not sure what the best method is. What would be the case for OSPF vs BGP?

DPadula · ‎04-17-2024

Hi JGaiser,

Fortinet recommend iBGP instead of OSPF. Here are some links that might be helpful. I believe the first one is the most appropriate for your case.

JGaiser · ‎04-29-2024

This isn't quite getting me to where I need.

I have a lab network with 4 firewalls. 1 is a hub, 3 are spokes.

I have used the Wizard to setup hub and spoke setup between the 4 devices per this documentation: IPsec VPN wizard hub-and-spoke ADVPN support | FortiGate / FortiOS 6.2.0 | Fortinet Document Library

All of the tunnels are showing as up, however these problems remain:

-No traffic is flowing between the spokes and the hub at all. I would only like 2 of the spokes to be able to communicate with each other and the hub, while the 3rd spoke should only communicate with the hub. What additional settings that are not in the documentation need to be configured to allow this to happen?

-I am not able to find a way to configure SD-WAN as the outgoing interface on the spokes. The hub has 1 ISP connection. All of the spokes have 2. The test needs to conclude that the hub-and-spoke connections are able to use SD-WAN for high-availability.