A route-based IPsec VPN is the fundamental FortiGate feature that enables the propagation of dynamic routing protocol updates. This configuration method creates a virtual IPsec interface on the FortiGate. Because a routable virtual interface is created, it can be configured to participate in dynamic routing protocols such as OSPF and BGP, just like a physical interface. This allows the FortiGate to exchange routing updates with a remote peer through the encrypted tunnel, enabling dynamic route learning and propagation across the VPN.

A. Auto Discovery VPN (ADVPN): ADVPN is a specific architecture that uses dynamic routing over route-based VPNs to enable the creation of on-demand "shortcut" tunnels between spokes, but it is not the underlying feature that allows it.

B. Dynamic Routing Gateway: This is not a recognized feature name within FortiOS. It is a generic term and likely a distractor.

C. Virtual Routing and Forwarding (VRF): VRF is a feature used to create multiple, independent virtual routing tables on a single FortiGate for network segmentation. It does not enable routing over VPNs.

1. FortiOS Administration Guide 7.4.1 - IPsec VPN > Route-based IPsec VPN: "A route-based VPN creates a virtual IPsec network interface that applies encryption or decryption as needed to any traffic that it carries. [...] Because a virtual interface is created

you can route traffic using static or dynamic routing protocols

providing the flexibility to support dynamic routing protocols running over the IPsec VPN." (Section: Route-based IPsec VPN)

2. Fortinet Cookbook - OSPF over IPsec VPN (VTI): This official guide provides a step-by-step configuration for running OSPF over a standard route-based IPsec tunnel. The configuration does not require ADVPN

demonstrating that the route-based VPN itself is the enabling feature. (Document ID: FD35921)

3. FortiOS Administration Guide 7.4.1 - ADVPN: "Auto-Discovery VPN (ADVPN) is a technology that allows for creating a dynamic

full-meshed network. It uses a dynamic routing protocol (BGP or OSPF) to learn routes." This documentation shows that ADVPN is a consumer of the dynamic routing over VPN capability

not the enabler of it. (Section: ADVPN)