An administrator must enable direct communication between multiple spokes in a company's network. Each spoke has more than one internet connection. The requirement is for the spokes to connect directly without passing through the hub, and for the links to automatically switch to the best available connection. How can this automatic detection and optimal link utilization between spokes be achieved?

ADVPN (Auto-Discovery VPN) 2.0 is the Fortinet technology specifically designed for this scenario. It enables spokes in a hub-and-spoke topology to create dynamic, on-demand IPsec tunnels (shortcuts) directly between each other, bypassing the hub. The "2.0" designation refers to its tight integration with SD-WAN, which allows it to manage multiple internet connections (underlays) per spoke. By using SD-WAN performance SLAs to monitor link quality (latency, jitter, packet loss), ADVPN 2.0 can automatically select the best-performing path for the shortcut tunnel, ensuring optimal link utilization and seamless failover.

A. Set up OSPF routing over static VPN tunnels between spokes. This requires a full mesh of static tunnels, which is not scalable. OSPF alone does not provide advanced link quality-based path selection like SD-WAN.
C. Establish static VPN tunnels between spokes with predefined backup routes. This is a rigid, non-scalable solution. It relies on basic static failover, not the dynamic, performance-based optimization required by the scenario.
D. Implement SD-WAN policies at the hub to manage spoke link quality. Placing SD-WAN policies only on the hub would manage hub-to-spoke traffic but would not facilitate the required direct spoke-to-spoke communication. ---

1. FortiOS Administration Guide 7.0.12 | IPsec VPN > Auto-discovery VPN (ADVPN)

Section: Auto-discovery VPN (ADVPN)

Content: "ADVPN is a technology that allows a traditional hub-and-spoke VPN’s spokes to establish dynamic

on-demand

direct tunnels

known as shortcuts

between each other to avoid routing traffic through the hub... When ADVPN is combined with SD-WAN

it is possible to have ADVPN shortcuts on all overlays." This directly supports the dynamic tunnel creation and multi-link capability.

2. FortiOS SD-WAN Architecture Guide 7.0.0

Section: 4.3. ADVPN with SD-WAN

Content: "ADVPN with SD-WAN allows spokes to establish dynamic tunnels between each other over the available underlays. SD-WAN rules can be used to select the best link for the ADVPN shortcut based on the measured quality of the links." This confirms that the combination of ADVPN and SD-WAN achieves the automatic link optimization requirement.

3. Fortinet Cookbook | ADVPN with SD-WAN (7.0.2)

Section: Introduction

Content: "This recipe details how to configure ADVPN with SD-WAN to allow spokes to establish dynamic tunnels between each other over the available underlays. SD-WAN rules can be used to select the best link for the ADVPN shortcut based on the measured quality of the links." This provides a practical implementation guide confirming the functionality described in the correct answer.