When configuring a loopback interface as the BGP source for connecting to an ISP, two important settings must be applied:
1. Enable EBGP Multihop (ebgp-enforce-multihop)


2. Set the Update Source (update-source)

Comprehensive and Detailed Explanation From Exact Extract documents and Knowledge:
In large-scale enterprise deployments like ADVPN (Auto-Discovery VPN), managing a huge number of individual BGP neighbor statements is not scalable. To scale the establishment and management of iBGP sessions , FortiGate utilizes the neighbor-range parameter.
According to the ADVPN configuration guide, the neighbor-range command allows a Hub to listen for and automatically accept dynamic BGP peering requests from any Spoke within a specified IP prefix range. This eliminates the need for the administrator to manually define each Spoke ' s IP address on the Hub, which is essential for scaling to hundreds or thousands of branches. While route-reflector-client (Option C) is a parameter used within the neighbor-group (Option A) to allow the Hub to reflect routes, it is the neighbor- range that technically scales the Hub ' s ability to handle the large volume of incoming sessions.

Comprehensive and Detailed Explanation From Exact Extract documents and Knowledge:
Efficiently deploying ADVPN in an enterprise environment requires centralized management and automation to handle the large number of spokes.
* VPN Manager (A): In FortiManager, the VPN Manager is a centralized orchestration tool. By creating a VPN community and enabling the " ADVPN " toggle, FortiManager automatically generates the complex configurations required (such as auto-discovery-sender on the Hub and auto-discovery- receiver on the Spokes) and pushes them to all managed devices.
* IPsec Provisioning Templates (D): Provisioning templates allow administrators to define standardized IPsec settings for multiple devices simultaneously. Using these templates to enable ADVPN ensures that every spoke has a consistent configuration, which is critical for the " shortcuts " (dynamic spoke-to- spoke tunnels) to establish correctly.
Options B and C are incorrect because ADVPN ' s primary strength is its ability to handle dynamic links regardless of status (though SD-WAN is often used alongside it) and its reliance on the actual tunnel interfaces rather than loopbacks for the discovery process.