CloudLabBox
Try the free demo

Firewalls and VPNs lab 11 of 16

Hub and spoke - DMVPN phase 3 on IOS and ADVPN on FortiGate

Run two hub-and-spoke VPNs side by side. Protect an IOS DMVPN with IKEv2 and turn on phase 3 so spokes build direct tunnels after an NHRP redirect, then turn on ADVPN on a FortiGate dial-up hub with BGP so its spokes do the same, and compare how each one finds the shortcut.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 7,680 MB in total. That fits the free demo too.

In your workspace: Shared, then Firewalls and VPNs multi-vendor guided labs, then 11 - Hub and spoke - DMVPN phase 3 on IOS and ADVPN on FortiGate

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 100 minutes
Nodes need
6 vCPU, 7,680 MB
Smallest plan
Lite

The scenario

Fernhill Garden Centres runs its older stores on Cisco routers joined by DMVPN, and is trialling FortiGates with ADVPN for new stores. Both designs are hub and spoke, and both still send store-to-store traffic (stock look-ups, the till network) the long way round, through the hub. Your job: protect the DMVPN with IPsec, then let both sets of spokes build direct tunnels to each other on demand, and compare how each vendor does it.

OverlayHubSpoke 1Spoke 2
Cisco DMVPN, Tunnel0 172.16.0.0/24, EIGRP 10R-HUB 198.51.100.1, 172.16.0.1, LAN 10.1.1.0/24R-SP1 .2, 172.16.0.2, LAN 10.1.2.0/24R-SP2 .3, 172.16.0.3, LAN 10.1.3.0/24
FortiGate ADVPN, iBGP AS 65010F-HUB 198.51.100.11, SPOKES 172.16.10.254, LAN 10.2.1.0/24F-SP1 .12, HUB 172.16.10.2, LAN 10.2.2.0/24F-SP2 .13, HUB 172.16.10.3, LAN 10.2.3.0/24

The store LANs are loopbacks (Loopback1 on IOS, lo1 on FortiGate). Crypto: IOS uses IKEv2 with AES-256-GCM, PRF SHA-384 and DH 20, key Fern-DMVPN-27. The FortiGates use DES with SHA-256 and DH 14, key Fern-ADVPN-27, because their evaluation licence offers only DES. In production they would use AES-256-GCM with DH 19, 20 or 21.

What you’ll practise

  • Protect an mGRE DMVPN with an IKEv2 IPsec profile in transport mode
  • Turn on DMVPN phase 3 with NHRP redirect and shortcut, and summarise routes at the hub
  • Read a FortiGate dial-up hub with BGP route reflection and exchange-interface-ip
  • Turn on ADVPN with auto-discovery-sender and auto-discovery-receiver
  • Prove spoke-to-spoke shortcuts on both vendors: show dmvpn, show ip route nhrp, get vpn ipsec tunnel summary, the routing table
  • Compare how NHRP and IKEv2 shortcut messages solve the same problem

The tasks

  1. Look at both overlays before you change anything
  2. Protect the DMVPN with IPsec
  3. DMVPN phase 3
  4. ADVPN on the FortiGates
  5. Compare

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Hub and spoke - DMVPN phase 3 on IOS and ADVPN on FortiGate6 nodes and 1 network, 6 links. Every link is listed as text below the diagram.R-HUBR-SP1R-SP2F-HUBF-SP1F-SP2InternetGi0/0port1Gi0/0port1Gi0/0port1
6 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R-HUB Gi0/0 to Internet (network)
  • R-SP1 Gi0/0 to Internet (network)
  • R-SP2 Gi0/0 to Internet (network)
  • F-HUB port1 to Internet (network)
  • F-SP1 port1 to Internet (network)
  • F-SP2 port1 to Internet (network)
Nodes in Hub and spoke - DMVPN phase 3 on IOS and ADVPN on FortiGate, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R-HUBCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R-SP1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R-SP2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
F-HUBFortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
F-SP1Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
F-SP2Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Firewalls and VPNs multi-vendor guided labs.

  3. Open 11 - Hub and spoke - DMVPN phase 3 on IOS and ADVPN on FortiGate and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Firewalls and VPNs labs

All Firewalls and VPNs labs

Related labs in other courses

CloudLabBox is independent of Check Point, Cisco, CompTIA, Fortinet, Juniper Networks, MikroTik, Netgate and Palo Alto Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.