Fortinet documentation makes clear that overlay IDs must be identical on hub and spoke for ADVPN to establish correctly:
“When configuring the root and downstream FortiGates the Fabric Overlay Orchestrator configures… IPsec overlay configuration (hub and spoke ADVPN tunnels).”
“The Fabric root will be the hub and any first-level downstream devices from the Fabric root will be spokes.”
In the scenario:
FortiSASE overlay ID = 100
FortiGate hub overlay ID = 101
Mismatch prevents tunnel establishment. Therefore, the fix is: B. The network overlay ID must match on FortiSASE and the hub.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit