When configuring ADVPN (Auto-Discovery VPN) to connect overlay networks across different hubs using IBGP and EBGP, special configurations are required to allow spokes from different overlay networks to dynamically establish tunnels.
* set auto-discovery-crossover enable
* This allows cross-hub tunnel discovery in an ADVPN deployment where multiple hubs are used.
* Since Hub A and Hub B belong to different overlays, enabling crossover discovery ensures that spokes from one overlay can dynamically create direct tunnels to spokes in the other overlay when needed.
* set enforce-multihop enable
* This setting ensures that BGP peers using loopback interfaces can establish connectivity even if they are not directly connected.
* Multihop BGP sessions are required when using loopback addresses as BGP peer sources because the connection might need to traverse multiple routers before reaching the BGP neighbor.
* This is especially useful in ADVPN deployments with multiple hubs, where routes might need to cross from one hub to another.

Since Core1 and Core2 are not designated as management VDOMs, they rely on the root VDOM for connectivity to external resources such as FortiGuard updates. If the root VDOM lacks a VDOM link to these VDOMs or cannot reach FortiGuard services, security features like web filtering will stop working.

The output of the get router info ospf status command provides key information about the OSPF (Open Shortest Path First) configuration on the FortiGate device.
The FortiGate device is connected to multiple areas
# The output states: " This router is an ABR "
# ABR (Area Border Router) means the device is connected to multiple OSPF areas and maintains routing information between them.
# This confirms that the FortiGate is not just in one area, but at least one backbone area (Area 0) and another OSPF area.
The FortiGate device injects external routing information
# The output states: " Supports opaque LSA "
# Opaque LSAs (Type 9, 10, and 11) are used in OSPF extensions, including those that support external route injection.
# Typically, ABRs or ASBRs (Autonomous System Boundary Routers) inject external routes, allowing routes from other routing protocols (such as BGP or static routes) to be advertised into OSPF.

In an ADVPN deployment using iBGP, the Hub uses dynamic BGP peering to manage a large number of spokes. The neighbor-range configuration is used to define the range of IP addresses from which the Hub will accept dynamic BGP connections.
* neighbor-group: Within the neighbor-range, you must specify a neighbor-group. This group acts as a template that defines the shared settings for all spokes in that range.
* remote-as: The remote-as is a mandatory parameter defined within the associated neighbor-group to identify the autonomous system of the spokes (which, in iBGP, matches the Hub ' s AS). While route- reflector-client is also a required setting for the Hub in this topology, it is a property configured under the neighbor-group, whereas neighbor-group and the group ' s remote-as are the foundational requirements for the range to function.