Architecture & Overview

ADVPN (Auto-Discovery VPN) allows spoke firewalls to dynamically establish direct on-demand IPsec tunnels between each other without hair-pinning traffic through the central Hub firewall. This runbook fuses official Admin Guide baselines with 8+ KB pitfalls regarding BGP route injection, net-device exhaustion and MSS clamping.

Applicable Subsystem Scope FortiGate firewalls running dynamic routing (BGP) over dialup IPsec tunnels with ADVPN extensions.
💡 Behavior Shift Notice (FortiOS 7.2 ➔ 7.4+ Evolution)

In FortiOS 7.2, dynamic routing over ADVPN required explicit neighbor-groups. Starting in 7.4+, BGP dynamic neighbor ranges inherit BFD and soft-reconfiguration automatically.

5-Phase Closed-Loop Execution Workflow

Click any step as you complete it to track progress and verify live impact.

01

Verify Hub Phase 1 Interface Baseline

Ensure the Hub firewall has dynamic listener configured with auto-discovery-sender enabled and add-route disabled.

get vpn ipsec tunnel summary
get router info bgp summary
02

Closed-Loop Spoke Shortcut Injection & MSS Clamping

Apply mandatory auto-discovery-receiver, net-device disable and TCP MSS clamping.

📡 PHASE 1: PRE-CHANGE BASELINE (T - 30s)

Capture current baseline telemetry before applying changes:

diagnose vpn ike gateway list
get router info bgp neighbors
⚡ PHASE 2: APPLY SURGICAL CHANGE (T = 0s)

Apply surgical FortiOS configuration on Spoke node:

config vpn ipsec phase1-interface
    edit "Hub-ADVPN"
        set auto-discovery-receiver enable
        set net-device disable
        set add-route disable
    next
end
config firewall policy
    edit 10
        set tcp-mss-sender 1350
        set tcp-mss-receiver 1350
    next
end
🔍 PHASE 3: LIVE IMPACT VERIFICATION (T + 10s)

Observe diagnostic telemetry diff immediately:

diagnose vpn tunnel list
🟢 SUCCESS: Shortcut tunnel establishes on-demand (Type: Dynamic Shortcut, SA established).
🟡 INEFFECTIVE: Spokes continue routing all traffic through Hub ➔ Verify 'set auto-discovery-sender enable' on Hub.
🔴 ADVERSE: BGP routes flap ➔ Verify 'set soft-reconfiguration enable' on peer.
🔒 PHASE 4: SAFETY AUTO-TEARDOWN
diagnose debug disable
diagnose debug reset
🔄 PHASE 5: 1-CLICK ROLLBACK (UNDO BLOCK)
config vpn ipsec phase1-interface
    edit "Hub-ADVPN"
        set auto-discovery-receiver disable
    next
end
03

Verify Dynamic Spoke-to-Spoke Routing Table Injection

Confirm BGP shortcut route injection with next-hop self override and verify end-to-end latency reduction.

get router info routing-table bgp
get router info routing-table all
Continuous Self-Healing

Daily Knowledge Base Synchronization

This runbook is actively monitored by the Ferrite Sentinel Daemon. Newly published Fortinet Technical Tips and firmware bug fixes are automatically incorporated within 24 hours.