NSE7 Advanced VPN and Zero Trust Practice Question
A network administrator configures a hub-and-spoke ADVPN with FortiGates. Phase 1 and phase 2 settings are correct, and spoke gateways can communicate with the hub. However, shortcut tunnels between spokes are not being established. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dynamic routing (BGP/OSPF) is not configured over the VPN overlay
ADVPN requires policy-based routing or routing protocol to propagate routes and trigger shortcut setup. Without a routing protocol like BGP/OSPF, spokes will not learn routes to other spokes, and shortcut negotiation fails.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DPD is disabled on the phase 1 interface
Why it's wrong here
DPD is for dead peer detection, not related to shortcut tunnel setup.
- ✗
The hub FortiGate has 'set auto-discovery-sender enable' configured
Why it's wrong here
This enables ADVPN on hub, but alone doesn't trigger shortcuts without routing.
- ✓
Dynamic routing (BGP/OSPF) is not configured over the VPN overlay
Why this is correct
ADVPN shortcut establishment relies on dynamic routing to exchange spoke routes via the hub. Without it, spokes don't know about each other.
- ✗
The spoke FortiGates do not have IKEv2 enabled
Why it's wrong here
ADVPN supports IKEv1 and IKEv2; IKEv2 is not mandatory for shortcut tunnels.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.