When multiple remote sites connect to the same hub using overlapping subnets, FortiGate needs to determine which route should be used for traffic forwarding. The route-overlap setting in IPsec Phase 2 allows FortiGate to handle this scenario by deciding whether to keep the existing route (use-old) or replace it with a new route (use-new).
In an ECMP (Equal-Cost Multi-Path) routing setup, both routes should be retained and balanced, but FortiGate does not support ECMP directly over overlapping routes in IPsec Phase 2. Instead, an administrator must decide which connection takes precedence using route-overlap settings.

Unlike IPS or antivirus databases, FortiGate does not store a full web filter database locally. Instead, FortiGate queries FortiGuard (or FortiManager, if configured) dynamically to classify and filter web content in real time.
Key points:
* Web filtering works on a cloud-based model:
* When a user requests a website, FortiGate queries FortiGuard servers to check its category and reputation.
* The response is then cached locally for faster lookups on repeated requests.
* No local web filter database version:
* Unlike IPS and antivirus, which download and store signature updates locally, web filtering relies on cloud-based queries.
* This is why no database version appears in the GUI.
* Flow mode vs Proxy mode:
* In proxy mode, FortiGate can cache some web filter data, improving performance.
* In flow mode, all queries happen dynamically, with no locally stored database.