From the Root FortiGate - System Administrator Configuration exhibit:
# The AdminSSO account has the super_admin_readonly role.
From the Downstream FortiGate - Security Fabric Settings exhibit:
# The Security Fabric role is set to Join Existing Fabric, meaning it will authenticate with the root FortiGate.
# SAML Single Sign-On (SSO) is enabled, and the default admin profile is set to super_admin_readonly.
When the AdminSSO user logs into the downstream FortiGate using SSO, the authentication request is sent to the root FortiGate, where AdminSSO has super_admin_readonly permissions. Since the downstream FortiGate inherits this permission through the Security Fabric configuration, the user will be granted super_admin_readonly access.

When configuring ADVPN (Auto-Discovery VPN) to connect overlay networks across different hubs using IBGP and EBGP, special configurations are required to allow spokes from different overlay networks to dynamically establish tunnels.
# set auto-discovery-crossover enable
# This allows cross-hub tunnel discovery in an ADVPN deployment where multiple hubs are used.
# Since Hub A and Hub B belong to different overlays, enabling crossover discovery ensures that spokes from one overlay can dynamically create direct tunnels to spokes in the other overlay when needed.
# set enforce-multihop enable
# This setting ensures that BGP peers using loopback interfaces can establish connectivity even if they are not directly connected.
# Multihop BGP sessions are required when using loopback addresses as BGP peer sources because the connection might need to traverse multiple routers before reaching the BGP neighbor.
# This is especially useful in ADVPN deployments with multiple hubs, where routes might need to cross from one hub to another.

Unlike IPS or antivirus databases, FortiGate does not store a full web filter database locally. Instead, FortiGate queries FortiGuard (or FortiManager, if configured) dynamically to classify and filter web content in real time.
Key points:
# Web filtering works on a cloud-based model:
# When a user requests a website, FortiGate queries FortiGuard servers to check its category and reputation.
# The response is then cached locally for faster lookups on repeated requests.
# No local web filter database version:
# Unlike IPS and antivirus, which download and store signature updates locally, web filtering relies on cloud-based queries.
# This is why no database version appears in the GUI.
# Flow mode vs Proxy mode:
# In proxy mode, FortiGate can cache some web filter data, improving performance.
# In flow mode, all queries happen dynamically, with no locally stored database.

From the OSPF status output, the key information is:
# "This router is an ASBR" # This means the FortiGate is acting as an Autonomous System Boundary Router (ASBR).
# An ASBR is responsible for injecting external routing information into OSPF from another routing protocol (such as BGP, static routes, or connected networks).

In a transparent mode Virtual Domain (VDOM) configuration, FortiGate operates as a Layer 2 bridge rather than performing Layer 3 routing. The set forward-domain <domain_ID> command is used to control how traffic is forwarded between interfaces within the same transparent VDOM.
A forward-domain acts as a broadcast domain, meaning only interfaces with the same forward-domain ID can exchange traffic. This setting is commonly used to separate different VLANs or network segments within the transparent VDOM while still allowing FortiGate to apply security policies.