The diagram shows amulti-area OSPF networkwhere:
#FortiGate Ais inOSPF Area 0 (Backbone area).
#FortiGate Bis inOSPF Area 0.0.0.1and is connected to anRIP network.
To ensure thatOSPF Area 0 (0.0.0.0) learns routes from the external RIP network, FortiGate B must redistribute RIP routes into OSPF.
Steps to achieve this:
1.Enable route redistribution on FortiGate Bto inject RIP-learned routes into OSPF.
2. This allows OSPFArea 0.0.0.1to forward RIP routes toOSPF Area 0 (0.0.0.0), making the external network visible.

ThisIPsec Phase 1 configurationdefines adynamicVPN tunnel that can accept connections from multiple peers. The settings chosen here suggest a configuration optimized fornetworks with intermittent traffic patternswhile ensuring resources are used efficiently.
Key configurations and their impact:
#set type dynamic# This allows multiple peers to establish connections dynamically without needing predefined IP addresses.
#set ike-version 2# UsesIKEv2, which is more efficient and supports features like EAP authentication and reduced rekeying overhead.
#set dpd on-idle# Dead Peer Detection (DPD) is triggeredonly when the tunnel is idle, reducing unnecessary keep-alive packets and improving resource utilization.
#set add-route enable# FortiGate automatically adds the route to the routing table when the tunnel is established, ensuring connectivity when needed.
#set proposal aes128-sha256 aes256-sha256# Uses strong encryption and hashing algorithms, ensuring a secure connection.
#set keylife 28800# Sets alonger key lifetime(8 hours), reducing the frequency of rekeying, which is beneficial for stable connections.
BecauseDPD is set to on-idle, the tunnel will not constantly send keep-alive messages but will still ensure connectivity when traffic is detected. This makes the configuration ideal fornetworks with regular but non- continuous traffic, balancing security and resource efficiency.

When multiple remote sites connect to thesame hubusingoverlapping subnets, FortiGate needs to determine which route should be used for traffic forwarding. Theroute-overlapsetting in IPsec Phase 2 allows FortiGate to handle this scenario by deciding whether to keep theexisting route(use-old) or replace it with anew route (use-new).
In anECMP (Equal-Cost Multi-Path) routing setup,both routes should be retained and balanced, but FortiGate does not supportECMP directly over overlapping routesin IPsec Phase 2. Instead, an administrator must decide which connection takes precedence usingroute-overlapsettings.

In a hub-and-spoke topology using OSPF over IPsec VPNs, thepoint-to-multipointnetwork type is necessary to establish neighbor adjacencies between the hub and spokes. This network type ensures that OSPF operates correctly without requiring a designated router (DR) and allows dynamic routing updates across the IPsec tunnels.

The issue occurs because FortiGate enforces the "do not fragment" (DF) bit in the packet, and the packet size exceeds the MTU of the network path. When the Windows PC1 (with an MTU of 1500 bytes) attempts to send a 1400-byte packet, the FortiGate interface (with an MTU of 1000 bytes) needs to fragment it. However, since the DF bit is set, FortiGate drops the packet instead of fragmenting it.
To resolve this, the user should adjust the ping packet size to fit within the path MTU. In this case, reducing the packet size to972 bytes(1000 bytes MTU minus 28 bytes for the IP and ICMP headers) should allow successful transmission.