Fortinet documentation makes clear that overlay IDs must be identical on hub and spoke for ADVPN to establish correctly:
"When configuring the root and downstream FortiGates the Fabric Overlay Orchestrator configures... IPsec overlay configuration (hub and spoke ADVPN tunnels)."
"The Fabric root will be the hub and any first-level downstream devices from the Fabric root will be spokes." In the scenario:
FortiSASE overlay ID = 100
FortiGate hub overlay ID = 101
Mismatch prevents tunnel establishment. Therefore, the fix is: B. The network overlay ID must match on FortiSASE and the hub.

The FortiSASE software installations page shows which endpoints have specific software installed, allowing administrators to monitor potentially unwanted applications across the network.

The Digital Experience Monitor (DEM) in FortiSASE measures and monitors network performance from the FortiSASE Points of Presence (PoPs) to specific SaaS or cloud applications, helping identify and troubleshoot performance issues across the service path.

Assigning hubs with different priorities in a FortiSASE SD-WAN deployment allows traffic to be routed through the optimal hub to meet SLA requirements and ensures redundancy by enabling automatic failover if the preferred hub becomes unavailable.

ZTNA enforces least-privileged access by verifying user identity and device posture before granting access to specific corporate applications, even when protected by an on-premises FortiGate.