hi,
some more general thoughts on how to design a new network.
To be secure, a network needs to be simple, robust and transparent. Simple so that one can grasp how the parts of the network work together easily. Robust means that small changes have equally small consequences. And transparent, all essential information is at your disposal at all times for you to manage the network.
At least that's what it's boils down to in my experience, dealing with networks for like 3 decades now.
In your case, I would try to use one template for the BOs and one for the HQ. That is, the same functionality would use the same VLAN ID (like VoIP is VLAN 101)*. If you're lucky the similarities are such that you can put the FMG to use and roll out one branch in no time, and then adjust the details (ISP etc.).
*hint: of course, do NOT reuse address ranges in different locations, even if you now do not intend to connect them. Always use unique ranges. RFC1918 provides so many choices that this should not be difficult.
IMHO BO to HQ needs IPsec site-to-site VPNs, no question. Corner cases like obtaining private addresses on the WAN side can still be included. In FortiOS, a no-brainer.
I'm not so much a fan of "fully meshed VPN" if more than 3-4 sites are involved. Simplicity is down, robustness might improve by having more redundancy, YMMV.
Much more important is routing in such a super-net (a network of sites all having networks). I'd always recommend using a dynamic routing protocol for 11 sites plus HQ, just because setup is easy and will pay off in the future with every network you need to connect to. Connecting networks itself is highly dynamic, you cannot foresee all connections you will need. So, OSPF is a good choice, quick and it relieves you a lot in case a node fails.
One hint for routing: assign a private IP address to each tunnel end (of course, stick with a scheme, like 'the smaller on HQ side, plus 1 on BO side'). You could as well create loopback addresses on each FGT but it's more work. Plan addresses such that you always have a super-net notation ready (e.g. 172.20.n.0/30 for BO <n>, 172.20.0.0/16 is the supernet).
When creating address objects, always make them routable. Can't be done in GUI afterwards, and it will come in handy later. Like, in static routes or in VPN phase 2 QM selectors. It's a pity that you cannot peek into a route which is based on a named object but it makes the routing table less error prone.
Hope this helps, all of this from my experience and not from books, highly subjective of course.
