CloudLabBox
Try the free demo

FortiGate SD-WAN lab 8 of 14

ADVPN shortcuts between spokes

Stop branch-to-branch traffic hairpinning through HQ: enable ADVPN so the hub offers shortcuts and the spokes build direct IPsec tunnels on demand, then prove the shortcut with the tunnel list, the routing table and a traceroute, and see how SD-WAN treats a shortcut.

Run this lab

It needs Standard: its 8 nodes are set to 8 vCPU and 9,216 MB in total.

In your workspace: Shared, then FortiGate SD-WAN guided labs, then 08 - ADVPN shortcuts between spokes

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 8 vCPU and 9,216 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 75 minutes
Nodes need
8 vCPU, 9,216 MB
Smallest plan
Standard

The scenario

Leeds and Bristol now share a warehouse system and phone each other all day. Every packet between them crosses HQ: up one overlay to the hub, back down another, twice the delay and twice the load on HQ's lines. You'll enable ADVPN (Auto-Discovery VPN), so the depots build direct tunnels to each other when they need them and drop back to the hub when they don't.

DeviceISP-AISP-BLANTunnel addresses (A / B)
HUB203.0.113.1192.0.2.110.1.10.0/24172.16.1.254 / 172.16.2.254
BR1203.0.113.2192.0.2.210.2.10.0/24, H2 .50172.16.1.2 / 172.16.2.2
BR2203.0.113.3192.0.2.310.3.10.0/24, H3 .50172.16.1.3 / 172.16.2.3

Evaluation licence. IPsec on these FortiGates offers DES only, so the overlays and shortcuts use des-sha256 with DH group 14. Production uses AES-256-GCM with DH group 19, 20 or 21.

What you’ll practise

  • Explain ADVPN: shortcut offers, on-demand spoke-to-spoke tunnels and why BGP must keep the spoke's next hop
  • Enable auto-discovery-sender on the hub and auto-discovery-receiver on the spokes
  • Trigger a shortcut and identify it in the tunnel list and the routing table
  • Prove the direct path with traceroute
  • Relate shortcuts to SD-WAN members, health checks and rules

The tasks

  1. Start the lab
  2. The hairpin
  3. Enable ADVPN
  4. Build a shortcut
  5. Shortcuts and SD-WAN

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of ADVPN shortcuts between spokes8 nodes and 2 networks, 12 links. Every link is listed as text below the diagram.HUBBR1BR2INETWANH1H2H3ISP-AISP-Bport1eth0port3eth0eth1port3eth0port3eth0eth0eth1port1port2port2port1port2
8 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HUB port1 to ISP-A (network)
  • HUB port2 to ISP-B (network)
  • HUB port3 to H1 eth0
  • BR1 port1 to WAN eth0
  • WAN eth1 to ISP-A (network)
  • BR1 port2 to ISP-B (network)
  • BR1 port3 to H2 eth0
  • BR2 port1 to ISP-A (network)
  • BR2 port2 to ISP-B (network)
  • BR2 port3 to H3 eth0
  • INET eth0 to ISP-A (network)
  • INET eth1 to ISP-B (network)
Nodes in ADVPN shortcuts between spokes, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HUBFortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
BR1Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
BR2Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
INETEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
WANAlpine WAN emulatorclbalpinewanem-alpine-wanem-3-20-31 vCPU, 512 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H2Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H3Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder FortiGate SD-WAN guided labs.

  3. Open 08 - ADVPN shortcuts between spokes and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More FortiGate SD-WAN labs

All FortiGate SD-WAN labs

Related labs in other courses

CloudLabBox is independent of Fortinet. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.