Introduction

When configuring FortiGate SD-WAN, Auto Discovery VPN (ADVPN) requires a carefully designed hub-and-spoke topology, dynamic IPsec tunnel configuration, and BGP route manipulation to enable efficient spoke-to-spoke communication without forcing all traffic to traverse the hub.

ADVPN in FortiGate SD-WAN

Auto Discovery VPN (ADVPN) enables the creation of dynamic shortcut tunnels between spoke sites within a hub-and-spoke VPN architecture. Traditionally, spoke-to-spoke traffic was required to pass through the central hub, increasing latency and consuming additional bandwidth.

ADVPN improves network efficiency by dynamically establishing direct tunnels between spokes when communication is required. When integrated with FortiGate SD-WAN, ADVPN enhances traffic steering across multiple WAN links while maintaining performance, reliability, and resiliency across distributed environments.

Challenges

While ADVPN provides significant performance improvements, large-scale deployments introduce additional design considerations. Network architects must carefully plan BGP routing policies, SD-WAN rules, and tunnel configurations to ensure predictable traffic behavior.

Furthermore, continuous monitoring of WAN link health, latency, and performance metrics is essential to ensure service requirements are maintained and SD-WAN can dynamically steer traffic over the optimal path. 

Conclusion

Deploying ADVPN with FortiGate SD-WAN requires the configuration of dynamic IPsec tunnels with automatic discovery, integration into SD-WAN zones, and the use of BGP features such as additional-paths for efficient route distribution.

When properly designed and implemented, this architecture provides low-latency, scalable, and resilient spoke-to-spoke connectivity across distributed enterprise networks.