NSE7-SSE-AR-26: Fortinet NSE 7 - FortiSASE 26 Architect

An ADVPN hub receives a SHORTCUT_QUERY from the originating spoke, uses the destination route lookup to identify the destination spoke, and relays the shortcut negotiation so the spokes can form a direct tunnel. The log shows receipt from 192.2.0.1, a lookup for 10.0.1.101 -> 10.0.3.101, and selection of another outgoing interface, which is hub forwarding behavior. Fortinet documents that initial spoke-to-spoke traffic goes through the hub and triggers the SHORTCUT_QUERY/SHORTCUT_REPLY exchange.