Difference between "config system gre-tunnel" and "set encapsulation gre"
I have discovered that there are two methods of building IPSEC GRE tunnels.
The method most often referenced is to build a typical interface-based VPN and set the phase 2 encapsulation mode to "transport". Then configure a third component -- a GRE tunnel under 'config system gre-tunnel'. In addition to this there is then also a GRE interface under system interfaces. (See https://kb.fortinet.com/kb/documentLink.do?externalID=FD33841 for reference)
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.