Hub-and-Spoke IPsec VPN: Enable Direct Spoke-to-Spoke Communication
A company has multiple branch offices connected via IPsec VPN in a hub-and-spoke topology. They want to enable direct communication between branch offices without routing traffic through the hub. Which THREE configurations are required on the hub FortiGate? (Choose three.)
Quick Answer
The answer is a firewall policy allowing traffic between the VPN interfaces, along with proper Phase 2 selectors and routes on the hub FortiGate. In a hub-and-spoke IPsec VPN, the hub must have routes to both spoke subnets and Phase 2 selectors that define the traffic between those spokes; without these, the hub cannot forward the encrypted packets. The firewall policy is the final gatekeeper—it must explicitly permit inter-spoke traffic on the VPN interfaces, or the packets will be dropped even if routing and encryption are correct. On the Fortinet NSE 4 exam, this question tests your understanding that the hub acts as a routing and policy intermediary, not just a tunnel endpoint. A common trap is thinking only Phase 2 selectors are needed, but the firewall policy is equally mandatory. Memory tip: think “Routes, Selectors, Policy”—the three pillars of spoke-to-spoke direct communication.
⚠ Common exam trap
It's easy for candidates to think only firewall policies are needed, forgetting that without static routes and proper Phase 2 selectors, the hub cannot route or encrypt traffic between branches, even with permissive policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static routes for each branch's subnet pointing to the respective VPN interface
Static routes for each branch's subnet pointing to the respective VPN interface are required on the hub FortiGate so that the hub knows how to forward traffic destined for one branch's subnet out the correct IPsec tunnel to the other branch. Without these routes, the hub would have no path to the remote branch subnets and would drop the traffic, preventing direct branch-to-branch communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable 'forward traffic' in Phase 1 settings
Why it's wrong here
There is no such setting; traffic forwarding is controlled by policies and routing.
- ✓
Static routes for each branch's subnet pointing to the respective VPN interface
Why this is correct
The hub needs routes to forward traffic between spokes.
- ✓
Phase 2 selectors that include both branch subnets in one proposal
Why this is correct
Each spoke's Phase 2 should include the other spoke's subnet so the hub can encrypt/decrypt.
- ✗
Disable anti-replay on all tunnels
Why it's wrong here
Disabling anti-replay is not required and reduces security.
- ✓
A firewall policy allowing traffic between the VPN interfaces
Why this is correct
An inter-VDOM or inter-zone policy to allow spoke-to-spoke traffic through the hub.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. In a hub-and-spoke IPsec VPN topology with FortiGate, the spoke sites cannot communicate directly with each other. What configuration change allows direct spoke-to-spoke communication?
medium- A.Set the 'add-route' option to 'enable' on the spoke Phase 1 settings
- B.Configure dynamic routing (BGP) on all sites and enable route exchange
- C.Add static routes on the hub pointing to each spoke's subnet via the respective tunnels
- ✓ D.Create a separate IPsec VPN between each spoke pair
Why D: In a hub-and-spoke IPsec VPN topology, spoke sites cannot communicate directly by default. To enable direct spoke-to-spoke communication, the most straightforward configuration change is to create separate IPsec VPN tunnels between each spoke pair. While ADVPN (Auto Discovery VPN) with dynamic routing is a more efficient method, it is not listed as an option. Option D directly establishes the required tunnels, allowing traffic to bypass the hub for spoke-to-spoke traffic. Other options are insufficient: Option A only adds routes for the hub, Option B only propagates routes without establishing direct tunnels, and Option C forces traffic through the hub.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.