Ultimate ADVPN Setup Guide: BGP & OSPF Hub and Spoke

Looking to set up ADVPN with BGP & OSPF Hub and Spoke configuration? This ultimate guide breaks down the process step by step for easy implementation.

[@staticroute]

ADVPN is an enhancement to dialup VPNs that allows Spoke to Spoke VPNs to dynamically form on demand, therefore virtually achieving a full mesh VPN with just a single IPSec VPN configuration. The auto-discovery packets exchange between sender (Hub) and receiver (Spokes) make this possible through shortcut messages! the biggest advantage is simplified routing whether you choose to use BGP or OSPF, the config remains relatively simple! Enjoy!

[@MyGutFeeling_]

Fantastic video. I was really struggling getting this to work until now.

[@juan5392]

Please, make more videos!. Your explanations are very good 😭

[@staticroute]

@@juan5392 most certainly..! Thank you.

[@rjnasr8078]

Hey .. Upgrading to Eve-NG .. nice to see.

[@staticroute]

@@rjnasr8078 😬 hey bro, to be honest, I’m not yet loyal to either one of them, but I want to give EVE a chance for a while…

[@rjnasr8078]

@@staticroute I had a lot of issues with GNS3 and it was very time consuming. So far eve-ng seems to be smoother.

[@staticroute]

​​⁠I noticed the same thing but both on EVE and GNS3, in my case configs that works one moment stop working for no reason, turns out it was related to device license status, if it turns to ‘invalid’, then all hell breaks loose…be on the lookout for that

[@rjnasr8078]

@@staticroute I thought I sent out a response to this ages ago. Yes I also had some weird stuff happening and have to start from scratch. Hope you're well.

[@GavinScruton]

This is a great video! Thank you very much! What router/node did you use for the "Internet" as I am trying to create a lab like this but battling to create the "false" internet. Thanks again!

[@staticroute]

Hey Gavin, it’s just 3 Cisco routers sharing routes using OSPF between themselves, the other one at the bottom is Out of band management…basically my home network so I can connect using GUI, going forward, I’ll zip and share all configs to the labs

[@GavinScruton]

@@staticroute Thank you very much!

[@doom986]

Great video and helped me alot setting things up. Question: can you do this but bgp on loopback interface so there would be no need to configure tunnel interface. Some Fortinet guides seem to suggest using loopback interfaces..?

[@staticroute]

That should be possible, when you enter into "config neighbour" BGP hierarchy, you are able to specify interface to associate with BGP as well as update source. I haven't done this type of deployment myself and I won't be able to lab it up anytime soon because I deleted this lab...annoying Fortinet license expiry issue, please give it a shot and let me know...

[@doom986]

Yeah I think I'll try to lab it at somepoint. Maybe it's more for larger networks/mssp's and not really an issue for us. I was just thinking that since i'm doing greenfield advpn/bgp setup would be better to do it with loopback from the start and make it more futureproof. Also I was looking at the 7.4 docs and there are some new features like active dynamic BGP neighbor triggered by ADVPN shortcut. I hope you can do more videos in the future👍👍

[@Rejo-ni3hz]

@staticroute can you do DLP policy and acme certificate policy