You are planning a large SD-WAN deployment with approximately 1000 spokes and want to allow ADVPN between the spokes. Some remote sites use FortiSASE…

For large-scale SD-WAN deployments involving a high number of spokes (1000 in this case), a scalable routing design is critical. The recommended Fortinet best practice is to use BGP peering over loopback interfaces. This approach significantly reduces the number of BGP neighbors the hub must manage, as each spoke establishes only one BGP session with the hub, regardless of the number of overlay tunnels. ADVPN relies on BGP to exchange routes between sites. When a spoke learns a route to another spoke via the hub, this information triggers the dynamic creation of a direct spoke-to-spoke shortcut tunnel, which is the essence of dynamic BGP for ADVPN shortcut routing. This design is also fully compatible with FortiSASE integration.

B: IPsec phase2 selectors define static traffic flows for a tunnel and are not used for the dynamic route exchange and on-demand tunnel creation required by ADVPN.

C: The "BGP per overlay" method is not scalable for 1000 spokes. It would require the hub to maintain a separate BGP session for each spoke on each overlay, leading to excessive resource consumption.

D: While BGP next-hop convergence is a feature used in SD-WAN, the core configuration method proposed, "BGP per overlay," is not suitable for a deployment of this size due to scalability limitations.

1. Fortinet SD-WAN Architecture Guide 7.6.1, Routing design > BGP on loopback, Page 51: This section explicitly contrasts "BGP per overlay" with "BGP on loopback," stating, "For large scale deployments, it is recommended to use the BGP on loopback design to reduce the number of BGP neighbors on the hub." It provides a clear example showing that for 1000 spokes and 2 overlays, BGP on loopback requires 1000 neighbors versus 2000 for BGP per overlay.

2. FortiOS Administration Guide 7.6.1, SD-WAN > ADVPN, Page 1019: This section describes the ADVPN mechanism, explaining, "BGP is used to advertise the networks behind the spokes... When a spoke wants to communicate with another spoke, the hub forwards the BGP information to the spoke, and the spoke uses that information to establish a direct IPsec tunnel (a shortcut) to the other spoke." This confirms the use of dynamic BGP for shortcut routing.

3. FortiSASE Administration Guide (24.1), Configuration > Connectors > Secure Private Access > FortiGate SD-WAN Integration: This guide details the integration of on-premise FortiGate SD-WAN with FortiSASE. The configuration examples consistently show the use of an IPsec tunnel with BGP for routing between the on-premise hub and the FortiSASE security PoP, reinforcing that BGP is the standard routing protocol for such integrations. A scalable BGP design like "BGP on loopback" is essential for the on-premise portion of this architecture.