You are tasked with configuring ADVPN 2.0 on an SD-WAN topology already configured for ADVPN. What should you do to implement ADVPN 2.0 in this…

ADVPN 2.0 integrates the creation of on-demand shortcut tunnels directly into SD-WAN policy routing. The primary configuration change to enable ADVPN 2.0 on an existing ADVPN topology is to modify the SD-WAN rules on the branch (spoke) devices. Specifically, the advpn-shortcut option must be enabled within the SD-WAN rules that are intended to trigger the creation of a shortcut tunnel. This allows for granular, policy-based control over which traffic sessions can establish direct spoke-to-spoke tunnels, which is the core enhancement of ADVPN 2.0. The hub's IPsec configuration remains fundamentally the same.

A. Update the IPsec tunnel configurations on the hub: The hub's core IPsec configuration for auto-discovery does not change significantly between ADVPN 1.0 and 2.0. The primary change is on the branches.

C. Update the IPsec tunnel configuration on the branches: While the IPsec tunnel is used, the specific setting that enables ADVPN 2.0 functionality (advpn-shortcut) is configured within the SD-WAN rules, not the IPsec tunnel settings.

D. Delete the existing ADVPN configuration and configure ADVPN 2.0: This is incorrect. ADVPN 2.0 is an enhancement, and an existing ADVPN 1.0 deployment can be migrated by modifying the branch SD-WAN configuration, not by starting over.

1. Fortinet SD-WAN Architecture for Enterprise 7.4 Guide

Chapter: ADVPN

Section: ADVPN 2.0.

"ADVPN 2.0 moves the shortcut logic from the IPsec tunnel to the SD-WAN rule. This allows for more granular control over which traffic can create shortcuts." (This directly supports the explanation).

The guide shows the configuration steps: "On the spokes

enable advpn-shortcut in the SD-WAN rule." This confirms the change is made to the SD-WAN configuration on the branches (spokes).

2. FortiOS 7.4.0 Administration Guide

Section: VPN > IPsec VPN > Auto-Discovery VPN (ADVPN).

The guide details the configuration for ADVPN 2.0

showing the CLI command set advpn-shortcut enable under config system sdwan > config rule. This explicitly places the configuration within the SD-WAN rule set on the spoke devices.