Fortinet ADVPN: A Scalable and Efficient VPN Solution

Fortinet ADVPN offers a scalable and efficient VPN solution that can handle large volumes of traffic. It's designed to provide secure and reliable connectivity between multiple locations.

Fortinet ADVPN uses a hub-and-spoke architecture to connect multiple sites, allowing for easy scalability and management. This architecture enables administrators to add new sites without disrupting existing connections.

One of the key benefits of Fortinet ADVPN is its ability to optimize network traffic, reducing latency and improving overall network performance. By doing so, it ensures that critical applications and services remain available and responsive.

ADVPN (Auto-Discovery VPN) is a feature in Fortinet's FortiOS that allows multiple sites to establish IPsec tunnels with each other, creating a mesh network. This is done using dynamic routing protocols like BGP or OSPF, and IPsec negotiation.

The concept of ADVPN is to create shortcut tunnels between spokes, bypassing the hub, for future traffic between the spokes. This is achieved by FortiGate dynamically determining the optimal route and initiating a shortcut IPsec tunnel between Spoke A and Spoke B.

To configure ADVPN, each spoke must have an IP address that is routable from any other spoke. Devices behind NAT are not currently supported. The feature requires the use of a dynamic routing protocol, and RIP is not a very scalable routing protocol, so it's advisable to use BGP instead of RIP when there are more than a few spokes.

Here are some key configuration requirements:

Here's a summary of the configuration requirements:

The auto-discovery process is only supported by IKEv1, and all spokes must be able to communicate with each other. The feature is designed to create shortcut tunnels between spokes, bypassing the hub, for future traffic between the spokes.

ADVPN uses proprietary logic based on dynamic routing protocols like BGP or OSPF, and IPsec negotiation to create shortcut tunnels. This is different from traditional DMVPN models, which use NHRP.

All spokes initially establish IPsec tunnels with the hub. This is a crucial step in setting up the ADVPN network.

FortiGate dynamically determines the optimal route and initiates a shortcut IPsec tunnel between spokes when needed. This allows traffic to bypass the hub and go directly through the new tunnel.

Here's a step-by-step overview of how ADVPN works:

Note that ADVPN assumes spokes will not be used to transit other spoke traffic. This means that traffic from one spoke will not use a tunnel from another spoke, even if it's a shorter route.

Fortinet ADVPN is a powerful technology that simplifies the process of setting up and managing VPN connections between multiple sites.

One of the key benefits of ADVPN is that it doesn't involve NHRP, instead using Fortinet's own method to detect and negotiate dynamic tunnels. This approach provides a more flexible and scalable solution.

ADVPN is fully compatible with Fortinet SD-WAN, making it easy to integrate with existing network infrastructure.

The technology supports BGP and OSPF over IPsec, allowing for dynamic routing and network redundancy.

ADVPN can be configured in different ways, including with redundant hubs and with mixed ADVPN-aware and non-ADVPN-aware spokes.

Here are some key technical details to consider when implementing ADVPN:

ADVPN can be configured using different modes, including Aggressive and Main mode, each with its own advantages and disadvantages.

ADVPN is a game-changer for large-scale VPN environments. It eliminates the need for static tunnels, which can be a bottleneck in high-traffic networks.

With ADVPN, you can establish direct spoke-to-spoke tunnels, reducing latency and improving bandwidth efficiency. This is especially beneficial for distributed enterprises and large branch networks.

ADVPN works on edge discovery and path management, making it a dynamic and automated solution. It doesn't require any specific protocol to establish tunnels amongst branches.

Here are some key benefits of ADVPN:

ADVPN also simplifies management by reducing the complexity of traditional VPN architectures. It uses dynamic protocols like BGP (iBGP) to exchange LAN route information amongst branches, making it a more efficient solution.

If you're experiencing issues with Fortinet ADVPN, start by checking your network configuration to ensure that the VPN connections are properly set up. Fortinet ADVPN relies on a robust network infrastructure to function correctly.

Make sure your VPN concentrators are properly configured and that the VPN tunnels are established correctly. This includes verifying the correct IP addresses and port numbers are used.

Verify that your FortiGate units are properly licensed and updated to the latest firmware. This will ensure you have the latest security patches and features.

Use the Fortinet ADVPN troubleshooting tool to diagnose and resolve common issues. This tool can help identify problems with your network configuration or VPN connections.

Regularly monitor your network traffic and VPN connections to identify potential issues before they become major problems. This will help you stay ahead of potential issues and maintain a secure network.

In a Fortinet ADVPN configuration, each site needs a unique IP address from an unused range. For instance, 10.100.0.0/16 can be used, with IP addresses assigned as follows: Chicago 10.100.0.4, Greenwich 10.100.0.5, New York 10.100.0.1, and so on.

Each site has one or more subnets that it protects and wants to make available to peers. For simplicity, let's assume each site has only one subnet per site, allocated as 10.0.4.0/16 for Chicago, 10.0.5.0/24 for Greenwich, and 10.0.1.0/24 for New York.

To configure a VPN interface, you'll need to specify the type (static or dynamic), interface, remote gateway, pre-shared key, and auto-discovery settings. For example, on the New York hub, you'd configure a static phase 1 interface with the IP address 10.100.0.4/32 and remote IP 10.100.0.1.

Here's a summary of the required settings for each site:

Note that the GUI may not support all ADVPN-related options, so CLI configuration commands may be necessary.

A typical ADVPN configuration with SD-WAN usually has two hubs, and each spoke connects to two ISPs and establishes VPN tunnels with both hubs.

Each hub uses wan1 to connect to the ISPs and port10 to connect to the internal network. The SD-WAN is configured on the spoke, using the two VPN interfaces as members and two rules to control traffic to headquarters or other spokes using ADVPN VPN interfaces.

The GUI does not support some ADVPN related options, so CLI configuration commands are used instead. This example shows a hub-and-spoke configuration using two hubs and one spoke, with the following setup:

The spoke uses two VPN interfaces, one for each hub, and sets up basic network configuration to let all hubs and spokes connect to their ISPs and the Internet.

Before Spoke vs Spoke VPN Shortcut, it's essential to understand the configuration steps.

You can check the status before a spoke vs spoke shortcut VPN is established by using the following CLI commands.