CloudLabBox
Try the free demo

FortiGate SD-WAN lab 13 of 14

Troubleshoot overlay routing and ADVPN

Four faults break the Kestrel overlay after a hub replacement: a tunnel that never comes up, BGP sessions that never start on one overlay, depots that can't reach each other, and spoke-to-spoke traffic that never takes a shortcut. Trace each from IKE to BGP to policy to ADVPN and fix it.

Run this lab

It needs Standard: its 8 nodes are set to 8 vCPU and 9,216 MB in total.

In your workspace: Shared, then FortiGate SD-WAN guided labs, then 13 - Troubleshoot overlay routing and ADVPN

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 8 vCPU and 9,216 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 75 minutes
Nodes need
8 vCPU, 9,216 MB
Smallest plan
Standard

The scenario

HQ's FortiGate failed on Friday and a contractor rebuilt it (HUB) from notes; on Saturday someone also "re-keyed" a tunnel at Bristol. Since then: Bristol only uses one overlay, overlay B carries no routes for anyone, the depots can't reach each other at all, and when that's fixed their traffic still crosses HQ instead of taking ADVPN shortcuts. The intended design is labs 06 and 08 combined.

Intended design

ItemIntended
IPsecIKEv2, PSK LabVpnKey1!, des-sha256, DH 14; hub OL_A/OL_B dial-up with auto-discovery-sender; spokes HUB_A/HUB_B with auto-discovery-receiver
Tunnel addressesoverlay A 172.16.1.0/24, overlay B 172.16.2.0/24; hub .254, BR1 .2, BR2 .3
BGPAS 65000; hub neighbor ranges 172.16.1.0/24 (SPOKES_A) and 172.16.2.0/24 (SPOKES_B), route reflector
Hub policies2 Spokes-to-HQ, 3 HQ-to-Spokes, 4 Spoke-to-Spoke, 5 Overlay-health-checks

There are four faults: three on HUB and one on BR2. BR1 is correct.

Evaluation licence. IPsec on these FortiGates offers DES only (des-sha256 here). Production uses AES-256-GCM with DH group 19, 20 or 21.

What you’ll practise

  • Troubleshoot overlays in layers: IKE, tunnel, BGP, routes, policy, then ADVPN
  • Diagnose an IKE authentication failure with tunnel lists and IKE debug
  • Diagnose BGP sessions that never start on a dial-up hub
  • Diagnose spoke-to-spoke failures and missing ADVPN shortcuts
  • Prove the repaired overlay with BGP, routing, pings and a shortcut

The tasks

  1. Start the lab
  2. Tunnels first
  3. Then BGP
  4. Then spoke-to-spoke traffic
  5. Then ADVPN

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Troubleshoot overlay routing and ADVPN8 nodes and 2 networks, 12 links. Every link is listed as text below the diagram.HUBBR1BR2INETWANH1H2H3ISP-AISP-Bport1eth0port3eth0eth1port3eth0port3eth0eth0eth1port1port2port2port1port2
8 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HUB port1 to ISP-A (network)
  • HUB port2 to ISP-B (network)
  • HUB port3 to H1 eth0
  • BR1 port1 to WAN eth0
  • WAN eth1 to ISP-A (network)
  • BR1 port2 to ISP-B (network)
  • BR1 port3 to H2 eth0
  • BR2 port1 to ISP-A (network)
  • BR2 port2 to ISP-B (network)
  • BR2 port3 to H3 eth0
  • INET eth0 to ISP-A (network)
  • INET eth1 to ISP-B (network)
Nodes in Troubleshoot overlay routing and ADVPN, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HUBFortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
BR1Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
BR2Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
INETEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
WANAlpine WAN emulatorclbalpinewanem-alpine-wanem-3-20-31 vCPU, 512 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H2Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H3Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder FortiGate SD-WAN guided labs.

  3. Open 13 - Troubleshoot overlay routing and ADVPN and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More FortiGate SD-WAN labs

All FortiGate SD-WAN labs

Related labs in other courses

CloudLabBox is independent of Fortinet. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.