Ferritaas Incident Intelligence
Defect Intelligence Report Bug 0877912 Severity: High (P2)

IPsec ADVPN Shortcut Spoofing & Route Flapping over Dual Hub Topologies

In redundant dual-hub SD-WAN architectures, simultaneous NHRP shortcut resolution replies trigger route table collisions on spoke FortiGates, causing relentless /32 host route flapping and voice/video traffic disruption.

🚀 Open Full Runbook & Live Automation on Ferrite → Browse Known Issues Directory
⏱️ Est. Triage: 8–10 mins | Automated CLI Available

Technical Root Cause Analysis

In enterprise SD-WAN architectures, spoke firewalls establish redundant Auto-Discovery VPN (ADVPN) Phase 1 tunnels to both Hub-1 (Primary DC) and Hub-2 (Secondary DC). Under Next Hop Resolution Protocol (NHRP), when Spoke-A initiates traffic towards Spoke-B, initial packets flow through the hubs. Both hubs notice the transit session and generate an advpn-shortcut-reply (NHRP resolution reply) containing Spoke-B's public WAN IP and overlay address.

In FortiOS 7.2.2 through 7.2.6, when Spoke-A receives concurrent shortcut replies from both Hub-1 and Hub-2 within a tight timing window (sub-50ms), the spoke's NHRP routing subsystem attempts to install two concurrent host routes (/32) for Spoke-B via different dynamic virtual interfaces. The routing table daemon (rtdb) detects a next-hop gateway collision and withdraws the newly installed route, only to reinstall it when the secondary reply processes. This triggers an uncontrolled route flapping cycle, oscillating traffic between dynamic direct spoke tunnels and hub transit overlays.

[advpn:spoke1] nhrp_shortcut_reply: rcvd shortcut reply for peer Spoke-2 (10.255.1.42) via Hub-1 (tunnel_id 4) [advpn:spoke1] nhrp_shortcut_reply: rcvd shortcut reply for peer Spoke-2 (10.255.1.42) via Hub-2 (tunnel_id 5) [rtdb] collision: route 10.255.1.42/32 dev advpn_spk_0 already exists with different gateway! [rtdb] delete route 10.255.1.42/32 -> withdraw BGP next-hop -> reinstall (flap cycle 18) kernel: ipsec_advpn: shortcut table lockup, 142 packets dropped during route transition

Affected Firmware & Blast Radius Matrix

FortiOS Branch Vulnerable Builds Confirmed Clean Build Status & Workaround
FortiOS 7.2 7.2.2 – 7.2.6 7.2.7+ Tune BGP local-pref / hub priority
FortiOS 7.4 7.4.0 – 7.4.1 7.4.2+ Apply single-hub query affinity
FortiOS 7.0 Not Affected 7.0.x Branch Clean Legacy NHRP arbitration logic avoids collision

Platform Impact: Affects FortiGate 40F through 400F spoke appliances connected to dual-hub or multi-hub ADVPN SD-WAN overlays with BGP dynamic routing.

Step 01: Free Verification CLI (Safe Read-Only)

Execute these diagnostic commands to inspect your active ADVPN shortcut tunnels and observe real-time route oscillation in the spoke FIB:

Diagnostic Commands

# 1. View all active dynamic ADVPN shortcut tunnels
diagnose vpn tunnel list | grep -i advpn

# 2. Inspect the routing table for flapping /32 shortcut entries
get router info routing-table all | grep -E "shortcut|advpn"

# 3. Check IKE daemon status and active dynamic SA counts
diagnose vpn ike status

Remediation & Workaround Steps (Teaser Preview)

Follow the complete step-by-step remediation guide in the Ferrite interactive platform:

Step 02: Trace NHRP Control Packet Collisions

Run targeted packet filters on overlay interfaces to isolate duplicate shortcut response packets.

🔒 Interactive CLI Available in Ferrite Runbook #13

Step 03: Enforce Hub Priority with BGP Community Tagging

Configure BGP route-maps on Hub-1 and Hub-2 to assign hierarchical preference and avoid simultaneous replies.

🔒 Interactive CLI Available in Ferrite Runbook #13

Step 04: Restrict Spoke auto-discovery-receiver Affinity

Lock shortcut discovery query generation to the primary overlay interface until link failure.

🔒 Interactive CLI Available in Ferrite Runbook #13
⚡ Ferrite Platform Superpowers

Execute the Complete Runbook with Live Browser Automation

Connect your FortiGate via browser console (Web Serial) or local SSH bridge, verify each command in real-time, generate ready-to-run Tera Term scripts, and export sanitized TAC dossiers.

⚡
Live Browser Automation Direct terminal connection with live step checkoff.
📟
1-Click Tera Term (.ttl) Generate scripts for air-gapped jumpboxes.
🛡️
Zero-Trust Scrubber Scrub serials and credentials in local browser RAM.
📄
TAC P1 Escalation Dossier Standardized evidence export with SHA-256 seal.

Frequently Asked Questions

Why does this only occur in dual-hub setups?

In single-hub deployments, only one NHRP shortcut resolution offer is ever generated per spoke-to-spoke flow. With two active hubs, both observe the initial transit packets and simultaneously offer conflicting shortcut routes.

Does disabling ADVPN solve the flapping?

Disabling auto-discovery-receiver stops shortcut creation and forces all traffic through the hubs, which stops the flapping but increases hub bandwidth consumption and latency.

Which FortiOS release provides the permanent fix?

FortiOS 7.2.7 GA and 7.4.2 GA implement an atomic tie-breaking algorithm that suppresses redundant shortcut replies when an existing shortcut negotiation is in flight.