IPsec ADVPN Shortcut Query Drop Blackholes Direct Spoke-to-Spoke Mesh
In dynamic Auto-Discovery VPN (ADVPN) architectures, shortcut negotiation query packets dropped during Phase 2 SA rekey intervals cause spokes to purge hub transit routes before direct tunnels establish, blackholing spoke-to-spoke branch traffic.
Technical Root Cause Analysis
ADVPN allows branch spokes to negotiate dynamic, direct on-demand IPsec tunnels between each other without passing data through a central data center hub. When spoke 1 transmits packets to spoke 2, the hub forwards an IKE shortcut-query trigger instructing spoke 1 to establish a direct Phase 2 child SA with spoke 2's public WAN IP.
In affected FortiOS builds, if a child SA rekey occurs simultaneously or transit packet loss delays the response, the IKE daemon on the hub drops the shortcut inquiry. Spoke 1 preemptively removes its BGP or static route towards the hub, expecting direct shortcut route insertion. Because the shortcut failed, all spoke-to-spoke traffic drops into a routing blackhole.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.0 – 7.2.5 | 7.2.6+ | Enable auto-discovery-forwarder & patch |
| FortiOS 7.4 | 7.4.0 – 7.4.1 | 7.4.2+ | Upgrade recommended |
| FortiOS 7.0 | Low Occurrence | 7.0.12+ | Older shortcut state machine stable |
Platform Impact: Large-scale enterprise SD-WAN and ADVPN mesh topologies connecting regional branches over multi-hub overlays.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these commands to verify active IKE gateways, shortcut child SAs, and routing table entries:
Diagnostic Commands
# 1. List active IKE gateways and identify shortcut tunnels
diagnose vpn ike gateway list
# 2. Inspect active IPsec Phase 2 tunnel associations
diagnose vpn tunnel list
# 3. Check IP address assignment on ADVPN virtual tunnel interfaces
diagnose ip address list | grep advpn
# 4. Check routing table for dynamic shortcut route entries
get router info routing-table all | grep -i shortcutRemediation & Workaround Steps (Teaser Preview)
Access the complete ADVPN stabilization and rekey configuration guide in the Ferrite interactive platform:
Frequently Asked Questions
IKE shortcut query triggers are dropped by the hub during Phase 2 rekey collisions, causing spokes to delete hub routing paths before shortcut tunnels are established.
Enabling auto-discovery-forwarder on the hub and configuring redundant BGP summary routes ensures traffic continues flowing over the hub if shortcuts stall.
FortiOS 7.2.6 and 7.4.2 include rewritten IKE shortcut state synchronization.