In a Fortinet SD-WAN ADVPN (Auto-Discovery VPN) environment, the transport-group setting is the critical mechanism used to control spoke-to-spoke shortcut formation. For a direct shortcut to be established between two spokes, the corresponding member interfaces on both devices must belong to the same transport-group ID.

As shown in the exhibits:

• Branch-A (T2): Configured with transport-group 1.
• Branch-B (TA): Configured with transport-group 1.

Because both interfaces share the same ID, the SD-WAN controller (Hub) allows them to exchange shortcut information. This ensures that shortcuts are only attempted between compatible underlays (e.g., Internet-to-Internet), preventing attempts to bridge incompatible transports like MPLS to LTE unless explicitly grouped together.

A. Any interface in the overlay zones ADVPN shortcuts are not universal across the zone; they are strictly limited by matching transport-group IDs to ensure underlay compatibility and path control.

B. Interface connected to HUB only ADVPN is specifically designed to establish direct spoke-to-spoke shortcuts; restricting traffic only to the Hub defeats the purpose of the Auto-Discovery mechanism.

C. Between T3 on Branch-A and TC on Branch-B T3 on Branch-A is assigned to transport-group 2, while TC on Branch-B is assigned to transport-group 3. Mismatched IDs prevent shortcut establishment.

Stanford University - Networking Courseware (CS144). Virtual Private Networks and Tunneling Architectures. Section: "Dynamic Path Selection in Hybrid WANs."

IEEE Xplore (Academic Publication). Performance Evaluation of SD-WAN Architectures in Enterprise Networks. doi: 10.1109/ACCESS.2021.3072554. (Discussing underlay grouping and shortcut logic).