Refer to the exhibit, which shows an ADVPN network https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Fortinet_FCSS_EFW_AD-7.6/page_24_img_1.jpg An administrator must configure an ADVPN using IBGP and EBGP to connect overlay network 1 with 2. What two options must the administrator configure in BGP? (Choose two.)

set ebgp-enforce-multrhop enable

Probably A and B since you need ebgp-enforce-multihop for non-directly connected peers, and next-hop-self so the hub advertises itself properly. D is tempting but doesn’t apply here, I think. Agree?

Option A and B, these are needed for ADVPN with both eBGP/iBGP. Pretty sure that's right from practice tests.

Question 3 - Fortinet FCSS_EFW_AD-7.6 Real Exam Questions [Jan 2026 Update]

Q: 3

Refer to the exhibit, which shows an ADVPN network

An administrator must configure an ADVPN using IBGP and EBGP to connect overlay network 1 with 2. What two options must the administrator configure in BGP? (Choose two.)

Options

Correct Answer:

A, B

Explanation

In an ADVPN configuration that uses both iBGP and eBGP, specific BGP settings are required on the hub FortiGate.

1. set next-hop-self enable: This command is essential for the iBGP peering between the hub and its spokes. The hub acts as a route reflector. When it receives routes from one spoke, it must advertise them to other spokes with itself as the next hop. This action is the trigger for the spokes to initiate the on-demand shortcut tunnel.

2. set ebgp-enforce-multihop enable: This command is required for the eBGP peering. By default, eBGP peers must be directly connected. In a WAN or VPN environment, eBGP peers are typically multiple network hops apart. This setting allows the BGP session to be established between peers that are not on the same subnet.

Why Incorrect

C. set ibgp-enforce-multihop advpn: iBGP peers are not required to be directly connected by default, so enforcing multihop is generally unnecessary. The advpn keyword for this command is not a standard configuration for this scenario.

D. set attribute-unchanged next-hop: This command would prevent the hub from changing the next-hop attribute, which is the opposite of the required behavior. It would break the ADVPN shortcut mechanism.

References

1. Fortinet FortiOS 7.4.0 Administration Guide

VPN > IPsec VPN > Auto-Discovery VPN (ADVPN) > BGP configuration for the hub.

This section explicitly shows the command set next-hop-self enable as a required part of the iBGP neighbor group configuration on the hub. It states

"The hub must be configured as a route reflector for iBGP."

2. Fortinet FortiOS 7.4.0 Administration Guide

Routing > BGP > BGP concepts > eBGP multihop.

The documentation states: "By default

eBGP requires neighbors to be directly connected. If they are not

you must configure eBGP multihop routing... config router bgp ... config neighbor ... set ebgp-multihop enable". This confirms the necessity of the command for non-directly connected eBGP peers

as is the case in this ADVPN scenario.

3. Fortinet Cookbook

ADVPN with BGP as the routing protocol (2023/11/21).

In the "Configuring the Hub" section

under the BGP configuration for the neighbor group that includes the spokes

the command set next-hop-self enable is listed as a mandatory step. The explanation notes that this allows the hub to advertise itself as the next hop for routes learned from other spokes.

Premium Access Includes

FLASH OFFER

avail 10% DISCOUNT on YOUR PURCHASE