Hub-and-Spoke IPsec VPN: Enable Direct Spoke-to-Spoke Communication
In a hub-and-spoke IPsec VPN topology with FortiGate, the spoke sites cannot communicate directly with each other. What configuration change allows direct spoke-to-spoke communication?
⚠ Common exam trap
The trap is that candidates may think dynamic routing alone enables direct communication, but it only shares routes. Without ADVPN or explicit Phase 2 selectors, traffic still flows through the hub. The only listed option that actually creates a direct tunnel is D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a separate IPsec VPN between each spoke pair
In a hub-and-spoke IPsec VPN topology, spoke sites cannot communicate directly by default. To enable direct spoke-to-spoke communication, the most straightforward configuration change is to create separate IPsec VPN tunnels between each spoke pair. While ADVPN (Auto Discovery VPN) with dynamic routing is a more efficient method, it is not listed as an option. Option D directly establishes the required tunnels, allowing traffic to bypass the hub for spoke-to-spoke traffic. Other options are insufficient: Option A only adds routes for the hub, Option B only propagates routes without establishing direct tunnels, and Option C forces traffic through the hub.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the 'add-route' option to 'enable' on the spoke Phase 1 settings
Why it's wrong here
add-route only installs a route for the remote protected subnet into the routing table; it creates no tunnel between spokes, so their traffic still traverses the hub. It is tempting because it is a Phase 1 setting that appears to control connectivity, but it governs route insertion, not spoke-to-spoke tunnel establishment.
- ✗
Configure dynamic routing (BGP) on all sites and enable route exchange
Why it's wrong here
BGP exchanges routes but does not itself permit spoke-to-spoke traffic; the hub still has no tunnel or policy between spokes, so traffic is dropped. Dynamic routing is tempting because it scales large topologies, yet direct spoke-to-spoke requires a full-mesh or hub-assisted design, not merely route advertisement.
- ✗
Add static routes on the hub pointing to each spoke's subnet via the respective tunnels
Why it's wrong here
Static routes on the hub only direct traffic the hub already receives; spokes still send inter-spoke traffic to the hub, and no direct tunnel exists between them. Static routing is tempting for small stable topologies, but spoke-to-spoke communication needs either a full mesh or hub-forwarded design with matching policy.
- ✓
Create a separate IPsec VPN between each spoke pair
Why this is correct
A full mesh of separate IPsec tunnels between every spoke pair gives each site a direct path, bypassing the hub entirely. This satisfies the requirement for direct spoke-to-spoke communication, though it scales poorly as tunnel count grows quadratically.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 773-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.