In a Fortinet SD-WAN hub-and-spoke topology using IPsec and dynamic BGP (as in an ADVPN setup), specific IPsec settings are required for proper functionality.

1. net-device enable on the spoke: This setting is mandatory to create a virtual tunnel interface for the IPsec VPN. Dynamic routing protocols, such as BGP, require a routable interface to establish neighbor relationships and exchange routes. Without this, the tunnel would be policy-based and could not support dynamic routing.

2. localid on the spoke: The hub is configured as a dial-up IPsec server to accept connections from multiple spokes, which may have dynamic IP addresses. The localid parameter on the spoke provides a unique identifier (such as a name or FQDN) that it presents to the hub during IKE negotiation. The hub uses this ID to identify and authenticate the specific spoke, making it a recommended setting for secure and scalable dial-up topologies.

C. On the hub, set the parameter mode-cfg to enable.

This setting is used to push IP configuration to VPN clients, typically in remote access scenarios. It is not recommended for site-to-site SD-WAN with BGP, where tunnel IPs are statically assigned.

D. On the hub, set the tunnel type to static.

A static tunnel requires a pre-defined remote gateway IP. For a scalable hub-and-spoke model, the hub must be set to type dynamic to accept connections from any authorized spoke.

1. FortiOS Administration Guide 7.6.0 | SD-WAN > ADVPN with BGP as the routing protocol > Hub-and-spoke ADVPN configuration example: The configuration examples for both the hub and spokes explicitly show set net-device enable as a required step for the phase1-interface. This confirms that a network device (virtual interface) is essential for routing. (See the "Configuring the hub" and "Configuring the spokes" sections).

2. FortiOS CLI Reference 7.6.0 | vpn ipsec phase1-interface:

net-device: The documentation states this command enables or disables the network device. For route-based VPNs, which are necessary for BGP, this must be enabled to create the virtual IPsec interface.

localid : The documentation describes this as the "Local ID." In dial-up configurations, this is used by the client (spoke) to identify itself to the server (hub), which matches it against its peerid list.

3. Fortinet Cookbook | IPsec VPN > Dial-up IPsec VPN with two FortiGate units: This document provides a clear example of a dial-up VPN configuration, which is the basis for a scalable hub-and-spoke topology. It demonstrates the recommended use of set localid on the dial-up client (spoke) and set peerid on the server (hub) for proper peer identification.