What are the key differences between the FortiSASE BGP per overlay and BGP on loopback routing design methods? (Choose one answer)

The key difference lies in the BGP session architecture. The BGP per overlay method establishes a unique iBGP session for each individual spoke-to-hub IPsec tunnel. This design often uses mode-cfg to dynamically assign an IP address to the spoke's tunnel interface for peering. In contrast, the BGP on loopback method simplifies hub configuration by using a single iBGP session on the hub's loopback interface to peer with all spokes. This reduces the number of BGP neighbors on the hub and the number of advertised routes, as only the loopback IP is needed for peering.

B. This option incorrectly reverses the definitions of the two methods. BGP on loopback uses a single session, not multiple.

C. This option misrepresents the methods. BGP on loopback is a design choice for simplification, not the default, and BGP per overlay is not used for loopback interfaces.

D. This option is incorrect. BGP on loopback simplifies hub configuration, and BGP per overlay typically increases the number of advertised routes (tunnel IPs).

1. Fortinet. (2024). FortiOS Administration Guide 7.4.3. "BGP" section, under "Advanced VPN." This guide details different BGP configurations for IPsec VPNs, explaining the concepts of peering over tunnel interfaces versus loopback interfaces.

2. Fortinet. (2023). FortiSASE Secure Private Access Deployment Guide. "Routing Configuration" section. The guide discusses routing designs for connecting hubs to FortiSASE, including BGP configurations that align with these principles for establishing connectivity between spokes and the private application hub.

3. Fortinet. (2023). SD-WAN Architecture Guide. "Overlay Design - BGP" section. This document provides a detailed comparison of BGP overlay designs, including per-tunnel sessions versus a single session over a loopback, which are the core concepts in the question.