Troubleshooting Tip: ADVPN

bvagadia · ‎11-24-2021

Description

This article describes how to take debug in ADVPN when the shortcuts between Spokes do not establish, despite the tunnel being up.

Scope

FortiOS

Solution

If the connectivity between Hub and Spoke is fine, take the IKE debugs to further analyze the details for the ADVPN shortcut.

Take the debug on spoke to collect the shortcut negotiation

FGT SDW 1 # diagnose debug reset
FGT SDW 1 # diagnose vpn ike log filter clear
FGT SDW 1 # diagnose vpn ike log filter mdst-addr4 x.x.x.x y.y.y.y
FGT SDW 1 # diagnose debug application ike -1
FGT SDW 1 # diagnose debug console timestamp enable
FGT SDW 1 # diagnose debug enable

The above IKE debug on Spoke-1 is filtered for multiple IP addresses (mdst-addr4):

ISP1 IP address of the Hub (x.x.x.x).
ISP1 IP address of Spoke-2 (y.y.y.y).

It allows capturing the shortcut negotiation between Spoke1↔Hub as well as the shortcut tunnel establishment between Spoke-1↔Spoke-2.

Now trigger the shortcut by sending traffic from the Spoke-1 source to the Spoke-2 destination

Wait for 15 seconds and then stop debug with the help of the below command:

diagnose debug reset