Configuring Hub-and-Spoke IPsec VPN for Spoke-to-Spoke Traffic
An administrator needs to configure a hub-and-spoke IPsec VPN topology. Which TWO settings must be configured on the hub FortiGate to allow spokes to communicate with each other through the hub?
Quick Answer
The answer is to create firewall policies on the hub that allow traffic between the spoke networks and configure Phase 2 selectors with 0.0.0.0/0.0.0.0 on the hub. In a hub-and-spoke IPsec VPN, the hub must have Phase 2 selectors covering all possible spoke subnets—typically using 0.0.0.0/0—so that the IPsec security associations can encapsulate traffic from any spoke destined for another spoke. Without this broad selector, the hub would only forward traffic for explicitly defined subnets, breaking spoke-to-spoke communication. Additionally, firewall policies on the hub must explicitly permit inter-spoke traffic; otherwise, even with correct Phase 2 settings, the hub will drop the packets. On the Fortinet NSE 4 exam, this tests your understanding that the hub acts as a router and must both encrypt and forward traffic between spokes. A common trap is forgetting the firewall policy, thinking Phase 2 alone suffices. Memory tip: “Phase 2 for the path, policy for the pass”—the selector opens the tunnel, but the firewall lets the traffic through.
⚠ Common exam trap
Test-takers frequently think NAT or IKE version changes are required for spoke-to-spoke communication, but the core requirements are simply the correct Phase 2 selectors (0.0.0.0/0) and proper firewall policies on the hub to allow forwarding.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set Phase 2 selectors to 0.0.0.0/0 on the hub's side.
In a hub-and-spoke IPsec VPN topology, the hub must have Phase 2 selectors set to 0.0.0.0/0 (any-to-any) so that it can negotiate a single IPsec SA that covers all possible spoke-to-spoke traffic. This allows the hub to decrypt traffic from one spoke and re-encrypt it for another spoke without requiring separate Phase 2 selectors for each spoke pair. Additionally, firewall policies on the hub must explicitly permit traffic between the spoke networks, as the hub acts as a router forwarding inter-spoke traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable NAT on the hub's tunnel interface.
Why it's wrong here
NAT would break routing between spokes.
- ✓
Set Phase 2 selectors to 0.0.0.0/0 on the hub's side.
Why this is correct
This allows traffic to any destination, including other spokes.
- ✗
Configure the hub as a DNS server for the spokes.
Why it's wrong here
DNS is not required for spoke-to-spoke routing.
- ✗
Configure IKEv2 instead of IKEv1 on all tunnels.
Why it's wrong here
IKE version is not specific to spoke-to-spoke communication.
- ✓
Create firewall policies on the hub that allow traffic between the spoke networks.
Why this is correct
Policies must permit traffic from one spoke to another.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator has configured a hub-and-spoke IPsec VPN. The hub FortiGate has two Phase 2 selectors with spokes, but traffic between spokes is not routed via the hub. What must be configured on the hub to allow spoke-to-spoke communication?
hard- A.Set the hub as the default gateway on each spoke
- B.Use policy-based VPN instead of route-based
- C.Configure NAT on the hub
- ✓ D.Enable 'add-route' on the hub Phase 2
Why D: In a hub-and-spoke IPsec VPN, the hub FortiGate must have 'add-route' enabled on its Phase 2 selectors to automatically install routes for the spoke subnets into its routing table. Without this, the hub knows how to reach each spoke but does not have routes to forward traffic between spokes, so spoke-to-spoke traffic is dropped. Enabling 'add-route' on the hub's Phase 2 configurations ensures the hub learns the remote subnets and can route traffic between spokes.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.