ADVPN enables dynamic spoke-to-spoke IPsec shortcuts that eliminate unnecessary transit through hub devices after the initial discovery and negotiation process. In this scenario, spokes A1 and B2 belong to separate hub-and-spoke groups, interconnected through redundant IPsec tunnels.

Option A is correct because spoke devices use auto-discovery-receiver on their hub-facing IPsec Phase 1 interfaces. This enables the spokes to receive ADVPN shortcut discovery information needed to establish a direct tunnel to another spoke. Fortinet ' s ADVPN configuration examples explicitly demonstrate this receiver role.

Option D is correct because the interconnected hubs must forward the relevant ADVPN discovery messages across their inter-hub IPsec tunnels. Enabling auto-discovery-forwarder allows discovery signaling to traverse the hub-to-hub connections so that spokes belonging to different regions can discover one another.

Option B reverses the standard spoke and hub discovery roles. The hub normally performs the sender role on its spoke-facing tunnels, whereas the spoke uses the receiver role.

Option C similarly assigns the receiver role to the wrong side of the hub-to-spoke relationship.

The essential distinction is between receiving shortcut discovery at the spokes and forwarding discovery information between the hubs.