NSE7 Advanced VPN and Zero Trust Practice Question
An administrator is configuring a hub-and-spoke ADVPN with FortiGates. The spoke sites use dynamic public IP addresses. The administrator has enabled auto-discovery on the spoke and hub. However, shortcut tunnels are not being established between spokes that communicate frequently. What is the most likely missing configuration?
⚠ Common exam trap
Test-takers frequently assume auto-discovery only needs to be enabled on the hub, overlooking that each spoke must also have it enabled in its phase1 configuration to participate in shortcut negotiation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Auto-discovery is not enabled on the spoke's phase1 configuration
In a hub-and-spoke ADVPN, auto-discovery must be enabled on both the phase1 configuration of the spoke and the hub. If auto-discovery is not enabled on the spoke's phase1, the spoke will not send or process IKE informational exchanges (ADVPN messages) to negotiate shortcut tunnels with other spokes. This prevents dynamic shortcut establishment even if the hub has auto-discovery enabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Auto-discovery is not enabled on the spoke's phase1 configuration
Why this is correct
Auto-discovery must be enabled in the phase1 settings on both hub and spoke to allow shortcut negotiation. Without it, the spoke will not send or respond to shortcut requests.
- ✗
The spoke's phase2 proposal includes a different encryption algorithm than the hub
Why it's wrong here
Phase2 mismatch would affect the tunnel establishment itself, not specifically shortcut tunnel negotiation.
- ✗
The hub does not have a route to the spoke's local subnets
Why it's wrong here
The hub needs routes to all spoke subnets, but missing routes would not prevent shortcut negotiation between spokes directly.
- ✗
The spoke's VPN interface is not in the same VDOM as the hub
Why it's wrong here
VDOM mismatch would prevent any VPN connectivity; this is a more fundamental issue.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.