The issue described is a classic OSPF path selection behavior dictated by the version of the OSPF standard the device is following.
* RFC 1583 vs. RFC 2328:
* RFC 1583: This older standard does not distinguish between intra-area and inter-area paths when calculating the cost to an ASBR (Autonomous System Boundary Router) or an external route.
* RFC 2328: This newer standard (which is the default behavior in FortiOS 7.6) introduces a preference for intra-area paths over inter-area paths to an ASBR. This is designed to prevent routing loops that could occur in specific complex topologies.
* Analysis of the Exhibits:
* FortiGate_A (HQ): Its routing table (image_bd08a0.jpg) shows two equal-cost paths (O E2) to the external destination 100.75.5.1/32, one via ISP1 (10.0.1.1) and one via ISP2 (10.0.11.1).
* FortiGate_B (Branch): Its routing table (image_bd08a4.jpg) only shows a single path via FortiGate_A (10.0.2.1).
* Topology: FortiGate_A acts as the ABR/ASBR. In this specific scenario (taken from the Enterprise Firewall Study Guide), one of the paths advertised by FortiGate_A reaches FortiGate_B as an inter-area path while the other is seen as an intra-area path.
* Why only one route?
* By default, rfc-1583-compatible is disabled on FortiGate. Therefore, it follows RFC 2328 logic.
* Because RFC 2328 strictly prefers the intra-area path to the ASBR over the inter-area path, FortiGate_B discards the inter-area path and only installs the intra-area one in its routing table.
* To allow FortiGate_B to use both paths (ECMP) for the external route, the administrator must enable RFC 1583 compatibility using the following CLI command:
config router ospf
set rfc1583-compatible enable
end
* Once enabled, the FortiGate will stop preferring path types and will instead use the cost to determine the best path (or paths), allowing both routes to appear if the costs are equal.

The excessive DNS log requests with random subdomains suggest a DNS exfiltration attack, where attackers encode and transmit data via DNS queries. Since this technique can use both UDP and TLS (DoH - DNS over HTTPS), a comprehensive security approach is needed.
Using an IPS profile with DNS exfiltration-specific signatures allows FortiGate to:
# Detect and block abnormal DNS query patterns often used in exfiltration.
# Inspect encrypted DNS (DoH, DoT) traffic if SSL inspection is enabled.
# Identify known exfiltration domains and techniques based on FortiGuard threat intelligence.

When multiple remote sites connect to the same hub using overlapping subnets, FortiGate needs to determine which route should be used for traffic forwarding. The route-overlap setting in IPsec Phase 2 allows FortiGate to handle this scenario by deciding whether to keep the existing route (use-old) or replace it with a new route (use-new).
In an ECMP (Equal-Cost Multi-Path) routing setup, both routes should be retained and balanced, but FortiGate does not support ECMP directly over overlapping routes in IPsec Phase 2. Instead, an administrator must decide which connection takes precedence using route-overlap settings.

From the BGP neighbor status output, the key issue is that BGP is stuck in the " Idle " state, meaning the FortiGate is unable to establish a BGP session with its peer 100.65.4.1 (Remote AS 65300).
The output also shows:
# " Not directly connected EBGP " # This means the BGP peer is not on the same subnet, requiring multihop BGP.
# " Update source is Loopback " # Since a loopback interface is used, FortiGate must be configured to allow BGP neighbors over multiple hops.
To resolve this issue, the administrator must enable ebgp-enforce-multihop, which allows BGP sessions to be established even when the neighbors are not directly connected.

To minimize CPU and RAM usage while still enforcing security features like web filtering and application control, SSL certificate inspection mode is the best choice.
# SSL certificate inspection allows FortiGate to inspect only the SSL/TLS handshake, including the Server Name Indication (SNI) and certificate details, without decrypting the full encrypted payload.
# This enables features like web filtering and application control because FortiGate can determine the destination website or application based on SNI and certificate information.
# It significantly reduces system load compared to full SSL inspection, which requires full decryption and re-encryption of traffic.