In-depth look at Fortigate's ADVPN - Part II
In part I , we have configured dial-up IPSec tunnel at the Hub1 and eliminated any configuration change required at the Hub/HQ site when a new Spoke/Branch is added to the network. But there is a limitation. That is even though we have achieved configuration flexibility, our underlying topology is still hub-and-spoke. All spoke-to-spoke communication goes through the hub first. With ADVPN we can remove that limitation. We can achieve a fully meshed network by using ADVPN (Auto Discovery VPN). How ??? If someone is familiar with Cisco's DMVPN, the concepts are same here. Instead Fortinet's calls their implementation ADVPN . Before explaining how ADVPN works, have a look at our physical and routing topology from part I - ADVPN Physical Topology ADVPN Routing Topology For example, when Spoke2 tries to communicate with Spoke3 - as usual traffic goes to the Hub1. Hub1 knows the whole network topology. When Hub1 sees that two spokes are trying to communic...
