MENU
You configure the overlay tunnels for an SD-WAN hub-and-spoke topology defined with IPsec tunnels, BGP on loopback, and dynamic BGP.
Which are two recommended IPsec settings for this topology? (Choose two.)
BGP on loopback separates routing adjacency establishment from individual IPsec tunnel interface addresses. Combined with Dynamic BGP, it enables scalable SD-WAN overlays and dynamic spoke-to-spoke routing relationships.
Option A is correct for the intended reference design because enabling net-device on a spoke supports dedicated tunnel-interface handling for IPsec connections and dynamically created ADVPN shortcuts. This configuration appears in Fortinet's overlay provisioning examples.
Option C is correct because the spoke's localid supplies an identifiable IKE identity that the hub can use when authenticating and matching IPsec peers. It is particularly useful where multiple spokes share a hub's dial-up IPsec configuration or the hub requires specific peer identities.
Option B is incorrect because the hub normally acts as the dynamic IPsec dial-up responder, rather than being configured as a static tunnel endpoint for every spoke.
Option D is not a fundamental requirement of BGP-on-loopback routing. IKE mode configuration can distribute tunnel addresses, but loopback-based BGP does not inherently require IP addresses on each IPsec overlay.
An important implementation distinction is that net-device behavior can vary by FortiOS release and reference topology. Therefore, the actual production configuration should follow the selected FortiOS 7.6 deployment template rather than treating this combination as universal.
==========
Currently there are no comments in this discussion, be the first to comment!