You configure the overlay tunnels for an SD-WAN hub-and-spoke topology defined with IPsec tunnels, BGP...

BGP on loopback separates routing adjacency establishment from individual IPsec tunnel interface addresses. Combined with Dynamic BGP, it enables scalable SD-WAN overlays and dynamic spoke-to-spoke routing relationships.

Option A is correct for the intended reference design because enabling net-device on a spoke supports dedicated tunnel-interface handling for IPsec connections and dynamically created ADVPN shortcuts. This configuration appears in Fortinet ' s overlay provisioning examples.

Option C is correct because the spoke ' s localid supplies an identifiable IKE identity that the hub can use when authenticating and matching IPsec peers. It is particularly useful where multiple spokes share a hub ' s dial-up IPsec configuration or the hub requires specific peer identities.

Option B is incorrect because the hub normally acts as the dynamic IPsec dial-up responder, rather than being configured as a static tunnel endpoint for every spoke.

Option D is not a fundamental requirement of BGP-on-loopback routing. IKE mode configuration can distribute tunnel addresses, but loopback-based BGP does not inherently require IP addresses on each IPsec overlay.

An important implementation distinction is that net-device behavior can vary by FortiOS release and reference topology. Therefore, the actual production configuration should follow the selected FortiOS 7.6 deployment template rather than treating this combination as universal.