When designing an ADVPN (Auto-Discovery VPN) network for a large enterprise with spokes that have varying numbers of internet links, the main challenge is to minimize the number of peer connections and routes at the hub while maintaining scalability and efficiency.
Using a dynamic routing protocol (such as BGP or OSPF) with loopback interfaces helps in several ways:
- Reduces the number of peer connections at the hub by using a single loopback address per spoke instead of individual physical interfaces.
- Enables simplified route advertisement by dynamically learning and propagating routes instead of manually configuring static routes.
- Supports multiple internet links per spoke efficiently, as dynamic routing can automatically adjust to the best available path.
- Allows seamless failover if a spoke's internet link fails, ensuring continuous connectivity.

When standardizing the deployment of FortiGate devices across branches using FortiManager, the best practice is to use metadata variables. This allows for dynamic interface configuration while maintaining a single, consistent policy package for all branches. Metadata variables in FortiManager enable interface roles and configurations to be dynamically assigned based on the specific FortiGate device.
This ensures scalability and consistent security policy enforcement across all branches without manually adjusting interface settings for each device. When a new branch FortiGate is deployed, metadata variables automatically map to the correct physical interfaces, reducing manual configuration errors.

In a hub-and-spoke topology using OSPF over IPsec VPNs, the point-to-multipoint network type is necessary to establish neighbor adjacencies between the hub and spokes. This network type ensures that OSPF operates correctly without requiring a designated router (DR) and allows dynamic routing updates across the IPsec tunnels.