Fortinet NSE7_SSE_AD-25 Dumps

In FortiSASE, Zero Trust Network Access (ZTNA) tags—also known as security posture tags—are used to dynamically grant or deny access based on the real-time security state of an endpoint. This mechanism ensures that only devices meeting specific compliance requirements can access protected resources or the internet.

Endpoint Analysis: The Managed Endpoints exhibit shows that while Jumpbox only has the FortiSASE-Compliant tag, the Windows-AD endpoint has been assigned both FortiSASE-Compliant and FortiSASE-Non-Compliant tags. This indicates that a security posture check on the Windows-AD device has failed, triggering a rule that applies the non-compliant tag.

Policy Evaluation: The Secure Internet Access Policy table shows two custom policies. The first policy, named Non-compliant , uses the FortiSASE-Non-Compliant tag as its source and has the action set to Deny . The second policy, Web Traffic , allows access for FortiSASE-Compliant users.

Root Cause of Outage: Because FortiSASE (powered by FortiOS) processes security policies in a top-down sequence, the " Non-compliant " policy is evaluated first. Since Windows-AD matches the source criteria for this " Deny " policy, its traffic is blocked before it can reach the " Accept " policy.

Although the exhibit shows a warning icon for the FortiClient version on Windows-AD, the direct cause of the internet outage is the explicit Deny policy triggered by the change in the device ' s security posture (the application of the Non-Compliant tag).

The core of the issue shown in the exhibits is the lack of visibility into encrypted traffic.

HTTPS Encryption: The eicar.org website uses the HTTPS protocol for its downloads. This means the data payload, including the test malware file, is encrypted as it traverses the network.

SSL Inspection Modes: As seen in the Security profile group exhibit (image_5705fc.jpg), the SSL inspection mode is explicitly set to Certificate inspection mode .

Visibility Gap: Certificate inspection only analyzes the initial SSL handshake, such as the server certificate and SNI (Server Name Indication). It does not decrypt the traffic payload. Consequently, the antivirus engine in FortiSASE cannot " see " or scan the eicar.com-zip file hidden within the encrypted session.

Resolution Requirement: To detect and block malicious files over HTTPS, SSL Deep Inspection must be enabled. Deep inspection allows FortiSASE to act as a proxy, decrypting the traffic for full content scanning by the antivirus and IPS engines before re-encrypting it for the endpoint.

Log Analysis: While the web filtering logs (image_5704e5.jpg) show the traffic is " Allowed " because the URL is not blocked by a web filter category, this is only the first step of inspection. The antivirus engine is present but ineffective because it is blind to the encrypted content due to the lack of deep inspection.

In a FortiSASE environment, log management is governed by a cloud-native storage policy that prioritizes performance and resource availability.

Retention Policy Framework: All FortiSASE instances come with log retention enabled by default. The standard log retention period is 30 days , though administrators can customize this policy to any duration between 2 and 30 days . This policy applies across all log types, including traffic, security, and event logs.

Automatic Deletion (A): When logs exceed the configured retention threshold, FortiSASE automatically deletes the older logs from the platform. 2 This automatic purging is necessary to free up storage space on the cloud infrastructure and maintain compliance with the organization ' s data lifecycle settings.

Persistence and Recovery: Once logs are deleted due to the expiration of the retention period, they are generally unrecoverable from the FortiSASE platform.

Long-Term Storage Solutions: Because FortiSASE is not designed as a long-term archival solution, customers who need to store logs for months or years for regulatory compliance should configure log forwarding to an external server , such as a FortiAnalyzer or a remote Syslog server.

Analysis of Incorrect Options: * Option B and D: While traditional FortiAnalyzer deployments use SQL indexing and separate " Archive " (raw/compressed) vs. " Analytics " (SQL) tiers, FortiSASE uses a simplified cloud storage model where data is purged rather than archived or tier-shifted upon expiry.

Option C: While FortiSASE is part of the FortiCloud ecosystem, it does not automatically " back up " expired logs to another FortiCloud service; the deletion is final unless external forwarding is active.

When accessing the FortiSASE portal for the first time, an administrator must select data center locations for the following FortiSASE components:

Endpoint Management:

The data center location for endpoint management ensures that endpoint data and policies are managed and stored within the chosen geographical region.

Points of Presence (PoPs):

Points of Presence (PoPs) are the locations where FortiSASE services are delivered to users. Selecting PoP locations ensures optimal performance and connectivity for users based on their geographical distribution.

Logging:

The data center location for logging determines where log data is stored and managed. This is crucial for compliance and regulatory requirements, as well as for efficient log analysis and reporting.

The correct answer is B. By hashing log data . This question belongs to Analytics because it deals with FortiSASE log visibility, reporting, and log analysis. The FortiSASE study guide explains that FortiSASE has built-in local logging for monitoring network activity in the portal. It creates traffic logs with user sessions, destinations, protocols, and actions; security logs for detected threats; event logs for system activity; and endpoint management logs for FortiClient events. The guide also explains that FortiSASE can forward logs to FortiAnalyzer, syslog, or CEF servers for longer retention and centralized analytics.

For hiding personally identifiable user information, Fortinet’s FortiSASE documentation calls the feature log anonymization . It states that log anonymization hides user information, such as usernames, in dashboard widgets, logs, and other FortiSASE areas. When anonymization is enabled, FortiSASE uses a username anonymization hash salt ; FortiSASE then generates a hash based on the username and salt value and uses that hash to anonymize log information.

So the mechanism is hashing, not compression, deletion, or tokenization.

To implement Zero Trust Network Access (ZTNA) where a FortiGate hub enforces device posture and processes traffic directly, specific architectural and configuration steps are required on the FortiGate appliance.

ZTNA Access Proxy (B): The FortiGate must be configured as a ZTNA access proxy . In this role, the FortiGate acts as a secure gateway that mediates connections between remote users and internal applications. This setup ensures that all TCP traffic is intercepted and processed by the FortiGate, providing a direct, shortest-path connection that bypasses the FortiSASE cloud PoPs for the data plane.

ZTNA Servers and Policies (C): Within the FortiGate configuration, administrators must define ZTNA servers (which identify the protected applications or resources) and ZTNA policies . ZTNA policies are the enforcement rules that check for valid client certificates and specific ZTNA tags (synchronized from FortiSASE) before allowing access to a resource. This configuration allows the FortiGate to perform continuous posture checks on every session.

Posture Check Mechanism: While ZTNA tags are used, they are generally synchronized from the FortiSASE Endpoint Management Service (EMS) rather than manually configured on the FortiGate itself. This synchronization ensures the FortiGate has real-time visibility into the security posture (e.g., AV compliance, OS version) of the endpoints as reported by FortiClient.

Analysis of Incorrect Options:

Option A: Creating ZTNA tags manually on a FortiGate is technically possible but is not the recommended " setup " in a FortiSASE deployment, as tags are meant to be dynamically assigned by EMS and synced to the fabric.

Option D: " Private access policies on FortiSASE " refers to the SD-WAN Secure Private Access (SPA) use case. In the SD-WAN SPA model, traffic is steered through the FortiSASE PoP first, whereas the requirement specifically asks for TCP traffic to be processed by the FortiGate using ZTNA.

According to the NSE7 SASE Enterprise Guide (Pages 46 & 61) , deploying Secure Private Access (SPA) with SD-WAN provides advanced security and networking capabilities by routing traffic through global Points of Presence (PoPs).

Inline Security Inspection (D): A major advantage of this approach is that traffic is routed through FortiSASE PoPs before it reaches private applications. This enables inline security inspection , providing robust protection against threats by applying the full SASE security stack—including antivirus, intrusion prevention, and deep packet inspection—to private access traffic.

Support for TCP and UDP (B): Organizations with existing FortiGate SD-WAN deployments benefit from broader and seamless access to privately hosted applications. The SD-WAN SPA use case explicitly supports both TCP- and UDP-based applications , ensuring that legacy or specialized services that rely on UDP function correctly over the secure tunnel.

SD-WAN Optimization: This method leverages the benefits of SD-WAN to optimize traffic flow between the SASE PoP and the corporate SD-WAN hub or data center FortiGate. It is particularly useful for mission-critical applications that require an extra layer of security combined with path optimization.

Architecture: In this configuration, the FortiSASE Security PoPs act as spokes in the organization’s SD-WAN network, relying on IPsec VPN overlays and BGP for secure dynamic routing.

While ZTNA posture checks are a feature of the broader ecosystem, the NSE7 Guide specifically highlights inline inspection and application support (TCP/UDP) as primary advantages of the SD-WAN integrated SPA approach.

The VPN tunnel between the FortiSASE spoke and the FortiGate hub is not establishing due to the configuration of mode config, which is not supported by FortiSASE spoke devices. Mode config is used to assign IP addresses to VPN clients dynamically, but this feature is not applicable to FortiSASE spokes.

Mode Config in IPsec:

The configuration snippet shows that mode config is enabled in the IPsec phase 1 settings.

Mode config is typically used for VPN clients to dynamically receive an IP address from the VPN server, but it is not suitable for site-to-site VPN configurations involving FortiSASE spokes.

Configuration Adjustment:

To establish the VPN tunnel, you need to disable mode config in the IPsec phase 1 settings.

This adjustment will allow the FortiSASE spoke to properly establish the VPN tunnel with the FortiGate hub.

Steps to Disable Mode Config:

Access the VPN configuration on the FortiSASE spoke.

Edit the IPsec phase 1 settings to disable mode config.

Ensure other settings such as pre-shared key, remote gateway, and BGP configurations are correct and consistent with the FortiGate hub.

The exhibit ( image_6361c9.jpg ) displays a standard SASE onboarding email sent from the FortiSASE platform to an end user to facilitate the enrollment of their device.

Communication Source (D): This email is generated by the FortiSASE administrator through the Onboard Users menu in the FortiSASE portal. It provides the user with direct download links for the FortiClient application and a unique Invitation Code required for telemetry connection.

Installer Types and Automation (B): FortiSASE provides two primary methods for deploying the client agent:

Pre-configured Installer: This version is pre-packaged with the organization ' s unique invitation code built-in . When a user runs this installer, the invitation code step is skipped as the client automatically registers to the correct FortiSASE instance upon installation.

Manual Installer: This version requires the user to manually copy and paste the invitation code from the onboarding email into the FortiClient " Zero Trust Telemetry " menu to complete enrollment.

Analysis of Incorrect Options:

Option A: FortiSASE utilizes a unified agent (FortiClient). The components (VPN, ZTNA, Web Filter, etc.) are managed via Endpoint Profiles assigned in the SASE portal and pushed to the client automatically; they are not manually selected by the user during installation.

Option C: As noted above, if the administrator provides a pre-configured installer , the manual entry of the code is not required, making the statement that it must " always " be entered manually false.

In the context of Zero Trust Network Access (ZTNA) , security posture tagging is the fundamental mechanism used to enforce compliance and security standards before granting access to protected resources.

Granular Access Control: The primary purpose of tagging is to provide granular access control . 3 Instead of relying solely on static credentials, ZTNA uses these dynamic tags to determine if a device or user meets specific security requirements at the moment of the connection request.

Compliance-Based Enforcement: Tags are assigned based on the compliance status of the endpoint. For example, the FortiSASE Endpoint Management Service (EMS) can verify if a device has an active antivirus, is running a specific OS version, or is joined to the corporate domain. 5 If the device fails any of these checks, the " Compliant " tag is removed, and access is automatically revoked.

Dynamic and Continuous Assessment: Unlike traditional VPNs that check posture only at login, ZTNA posture tagging allows for continuous assessment . If a device ' s security posture changes—for instance, if the user disables their firewall—the tag is updated in real-time across the Security Fabric, and the ZTNA policy will immediately deny further access. 8

Integration with Policies: On the FortiGate (acting as a ZTNA proxy) or within FortiSASE, these tags are used as source criteria in ZTNA policies . 9 Only traffic originating from endpoints with the required tags (e.g., " EMS-Tag: Corporate-Managed " ) is permitted to reach the protected application.

The Secure Internet Access (SIA) use case that minimizes individual workstation or device setup is SIA for agentless remote users. This use case does not require installing FortiClient on endpoints or configuring explicit web proxy settings on web browser-based endpoints, making it the simplest and most efficient deployment.

SIA for Agentless Remote Users:

Agentless deployment allows remote users to connect to the SIA service without needing to install any client software or configure browser settings.

This approach reduces the setup and maintenance overhead for both users and administrators.

Minimized Setup:

Without the need for FortiClient installation or explicit proxy configuration, the deployment is straightforward and quick.

Users can securely access the internet with minimal disruption and administrative effort.

The distinction between SASE (Secure Access Service Edge) and SSE (Security Service Edge) is a fundamental architectural concept in modern networking and security.

SASE Definition: SASE is a comprehensive framework that converges networking capabilities (specifically SD-WAN) with cloud-native security services (SSE) into a single, unified service model.

SSE Definition: SSE represents the security-focused subset of SASE. 4 It encompasses the core security pillars required for secure access, including Secure Web Gateway (SWG) , Cloud Access Security Broker (CASB) , and Zero Trust Network Access (ZTNA) .

The Key Differentiator: While both solutions share the same security stack (SWG, CASB, ZTNA), SD-WAN (Software-Defined Wide Area Network) is the specific networking component that exists in a full SASE solution to provide intelligent path selection and optimized connectivity. SSE intentionally excludes these wide-area networking functions, focusing purely on the security service delivery layer.

According to the FortiSASE 25 Enterprise Administrator Study Guide , organizations that already have a robust networking infrastructure and only require a cloud-delivered security overlay would opt for SSE, whereas those seeking a complete transformation of both network and security would deploy a full SASE solution that includes SD-WAN.

For a customer looking to upgrade their legacy on-premises proxy to a cloud-based proxy for a hybrid network, the combination of Secure Web Gateway (SWG) and Inline Cloud Access Security Broker (CASB) features in FortiSASE will provide the necessary capabilities.

Secure Web Gateway (SWG):

SWG provides comprehensive web security by inspecting and filtering web traffic to protect against web-based threats.

It ensures that all web traffic, whether originating from on-premises or remote locations, is inspected and secured by the cloud-based proxy.

Inline Cloud Access Security Broker (CASB):

CASB enhances security by providing visibility and control over cloud applications and services.

Inline CASB integrates with SWG to enforce security policies for cloud application usage, preventing unauthorized access and data leakage.

There are two deployment methods used to connect a FortiExtender as a FortiSASE LAN extension:

Connect FortiExtender to FortiSASE using FortiZTP:

FortiZero Touch Provisioning (FortiZTP) simplifies the deployment process by allowing FortiExtender to automatically connect and configure itself with FortiSASE.

This method requires minimal manual configuration, making it efficient for large-scale deployments.

Enter the FortiSASE domain name in the FortiExtender GUI as a static discovery server:

Manually configuring the FortiSASE domain name in the FortiExtender GUI allows the extender to discover and connect to the FortiSASE infrastructure.

This static discovery method ensures that FortiExtender can establish a connection with FortiSASE using the provided domain name.

The correct answers are A and B . In the FortiGate ZTNA access proxy workflow, FortiSASE and FortiClient first exchange endpoint information, user login details, security posture, and certificate information. FortiSASE then synchronizes the FortiClient certificate and security posture tags with FortiGate. The study guide states that FortiGate verifies the certificate, performs a user check, and performs a posture check based on the security posture tags before allowing encrypted access to the protected applications. This directly supports option A.

Option B is also correct because the ZTNA access proxy provides a direct path to private resources. The guide describes the ZTNA access proxy use case as a direct connection to applications hosted behind FortiGate, with a TLS-encrypted tunnel automatically created from the endpoint to the access proxy. It further states that this use case offers the direct shortest path to private resources, improving performance and security. That makes it suitable for latency-sensitive applications. Option C is incorrect because this specific FortiGate ZTNA access proxy deployment requires FortiClient on endpoints; agentless ZTNA is handled separately through the FortiSASE agentless ZTNA portal. Option D is not stated as a benefit of this deployment model.

The FortiSASE On/off-net detection feature is a two-part configuration designed to optimize bandwidth and user experience by determining when a device is in a trusted environment.

Rule Set Definition: The first part involves defining what constitutes an " on-net " or " on-fabric " status. In this scenario, the customer successfully configured a rule set named CERT-PUBLIC-IP using the Connects with a known public IP detection type. This tells FortiSASE that if the endpoint’s public WAN IP matches the corporate gateway, it is considered to be on the corporate network.

Profile Exemption Logic: Defining the rule set is not enough to stop the VPN connection. Within the Endpoint Profile (under the Connection tab > On/off-net Settings), there is a specific toggle labeled Exempt endpoint from FortiSASE auto-connect when endpoint is on-net (or in some versions, Bypass FortiSASE when endpoint is on-net ).

Exhibit Analysis: Looking at the provided exhibit (image_57097d.jpg), the " Exempt endpoint from FortiSASE auto-connect... " toggle is clearly disabled (switched to the left).

Root Cause: Because this toggle is disabled, FortiClient identifies that it is " on-net " based on the IP rule, but it has no instruction to skip the VPN connection. Consequently, the " Automatically " initiate tunnel setting remains the dominant instruction, causing the VPN to connect regardless of the network location.

To resolve the issue, the administrator must enable the Exempt endpoint from FortiSASE auto-connect when endpoint is on-net option in the SASECert01 profile.

In the FortiSASE architecture, Network Lockdown is a security feature designed to prevent off-net (off-fabric) endpoints from accessing the internet or local network without the protection of the SASE security stack.

Triggering Lockdown: When an endpoint is determined to be " off-net " —meaning it does not satisfy the on-net rule sets defined in its endpoint profile—a timer starts for a configurable grace period .

Function of the Grace Period: During this period, the endpoint maintains full access to the LAN and the internet. 4 The specific purpose of this grace period is to provide the user with a window of time to attempt a connection to the FortiSASE VPN tunnel or an alternate corporate tunnel. 5 This ensures that users can authenticate and regain a secure " on-net " status before any connectivity restrictions are enforced.

Enforcement: If the grace period expires and the endpoint has failed to establish a VPN connection, FortiClient enforces a strict lockdown. 7 In this state, the device cannot reach the LAN or the internet, except for specifically defined " Exempt Destinations " (such as captive portal login pages or the FortiSASE portal itself).

Resetting the Timer: Any attempt to connect to the tunnel during the grace period resets the timer, providing additional opportunities for the user to remediate their connection status. 8

According to the FortiSASE 25 Administrator Study Guide , the grace period is an essential user-experience setting that balances strict " zero-trust " security with the practical need for users to access the network briefly to establish their secure tunnel.

For small branch offices (thin edges) where users utilize unmanaged personal devices (BYOD) like laptops and mobile phones, the most efficient way to provide Secure Internet Access (SIA) with minimal configuration is by deploying a FortiAP .

Thin Edge Integration: FortiSASE includes expanded integrations with the Fortinet WLAN portfolio, allowing FortiAP wireless access points to function as " thin edge " devices. These access points intelligently offload and steer traffic from the branch directly to the nearest FortiSASE Security Point of Presence (PoP).

No Endpoint Agents Required: Because the devices are personal and unmanaged, installing the FortiClient agent (Option A) is often not feasible or desirable. The FortiAP deployment secures all client devices at the location without requiring any endpoint agents .

Minimal Configuration & Zero-Touch: This solution is specifically designed for small office locations with limited budgets and no local IT staff. FortiSASE offers cloud-delivered management with zero-touch provisioning for FortiAP. Once the AP is connected, it automatically establishes a secure CAPWAP or IPsec tunnel to FortiSASE, ensuring all connected users are protected by the cloud security stack (Antivirus, Web Filtering, etc.) with almost no manual setup on the end-user side.

Why other options are less ideal:

Option C and D: SD-WAN on-ramp and FortiGate LAN extensions typically require a physical FortiGate appliance at the branch. For a small office with only ten users and personal devices, this adds unnecessary hardware costs and configuration complexity compared to a simple, cloud-managed FortiAP.

In FortiSASE, the Software Installations page (located under Network > Managed Endpoints ) provides a centralized view of all software inventory reported by the FortiClient agents. This feature is essential for administrators to maintain visibility into the environment and identify potentially unwanted applications (PUA) or unauthorized software installed on remote devices.

Software Inventory Reporting: FortiClient sends the endpoint ' s software inventory to FortiSASE upon initial registration and updates the portal whenever a change—such as an installation, update, or removal—occurs on the endpoint.

Available Information (Vendor): When viewing the global list of applications, the portal displays detailed metadata for each software entry. This includes the Vendor of the software and its specific version, allowing administrators to differentiate between reputable enterprise applications and suspicious third-party utilities.

Available Information (Endpoint Association): The interface includes an Endpoint Count field that indicates how many devices have a specific application installed. By selecting a specific application and using the View Endpoints action, the administrator can see a list of every individual endpoint where that software is currently active.

Incorrect Options: While license management is a general feature of the ecosystem, the Software Installations page itself does not track the license status of individual third-party applications (Option B). Similarly, while FortiSASE monitors traffic, the Software Installations inventory page does not report on the usage frequency (how often a user opens or uses the app) of the installed binaries (Option D).

By leveraging this inventory, administrators can proactively manage risk by identifying endpoints that possess high-risk software and taking remediation steps or applying ZTNA posture tags based on the presence of specific unauthorized software.

IP Address Management (IPAM) in FortiSASE is responsible for automatically allocating subnets to various services, including VPN tunnels and Edge devices. When an administrator modifies the default IPAM configuration, they must adhere to specific architectural scaling requirements.

Subnet Requirements per PoP: FortiSASE architecture requires a minimum amount of address space to be available for each provisioned Security Point of Presence (PoP) to handle internal routing and endpoint assignments. For the IPAM engine to function correctly and distribute unique subnets across the global infrastructure, the pool must provide at least one /20 subnet per security PoP . If the available space is smaller than this per-PoP requirement, the allocation logic may fail or produce unpredictable routing behavior.

Impact of Excessive Exclusions: In the exhibit (image_578940.png), the customer has defined a large summary pool of 172.16.0.0/12. However, they have configured eight separate /15 excluded subnets: 172.16.0.0/15, 172.18.0.0/15, 172.20.0.0/15, 172.22.0.0/15, 172.24.0.0/15, 172.26.0.0/15, 172.28.0.0/15, and 172.30.0.0/15.

Calculating the Exhaustion: A /12 network contains exactly eight /15 blocks. By excluding all eight /15 ranges listed in the exhibit, the customer has effectively excluded 100% of the available addresses from the primary 172.16.0.0/12 pool.

Connectivity Problems: When the IPAM pool is exhausted or overly restricted, FortiSASE cannot assign valid, non-overlapping subnets to the PoPs. This leads to connectivity problems for remote users and can cause the system to " fall back " to ranges it believes are available, even if they were intended to be excluded, or simply fail to establish tunnels entirely.

To resolve this, the administrator must ensure that the excluded subnets do not consume the entire pool and that the remaining unexcluded space is large enough to provide a /20 block for every active PoP in their subscription.

When remote users connected to FortiSASE require access to internal resources on Branch-2, the following process occurs:

SD-WAN Capability:

FortiSASE leverages SD-WAN to optimize traffic routing based on performance metrics and priorities.

In the priority settings, HUB-1 is configured with the highest priority (P1), whereas HUB-2 has a lower priority (P2).

Traffic Routing Decision:

FortiSASE evaluates the available hubs (HUB-1 and HUB-2) and selects HUB-1 due to its highest priority setting.

Once the traffic reaches HUB-1, it is then routed to the appropriate branch based on internal routing policies.

Branch-2 Access:

Since HUB-1 has the highest priority, FortiSASE directs the traffic to HUB-1.

HUB-1 then routes the traffic to Branch-2, providing the remote users access to the internal resources.

The correct answer is D. Web filter with inline-CASB . The FortiSASE study guide states that FortiCASB provides cloud-based and API-based capabilities for deep inspection of SaaS applications, enabling monitoring, analysis, and reporting. It also states that FortiSASE provides inline CASB functionality with a web filter and application control security features , while DLP protects data at rest and in motion.

This question specifically describes restricting Microsoft Office 365 access by tenant, meaning users should be allowed to access company-approved Microsoft 365 resources but blocked from logging in to non-company or personal resources. Fortinet’s FortiSASE documentation describes this exact use case as “restricted SaaS access,” where organizations restrict access to Microsoft Office 365, Google Workspace, and similar SaaS services by tenant to block non-company login attempts and prevent access to non-approved cloud resources. Fortinet’s Office 365 example confirms this is implemented through FortiSASE Web Filter with Inline-CASB, using inline-CASB headers to allow corporate domains and deny personal accounts.

FortiSASE is designed as a unified, single-vendor solution that specifically targets the convergence of networking and security to address the modern challenges of a distributed enterprise. 2

Multicloud and SaaS Adoption: FortiSASE addresses the surge in cloud-first strategies by providing Next-Generation Dual-Mode CASB (Cloud Access Security Broker). 3 This feature uses both inline and API-based inspection to provide comprehensive visibility into sanctioned and unsanctioned SaaS applications (Shadow IT), ensuring that data is protected regardless of whether it resides in AWS, Azure, Google Cloud, or SaaS platforms like Microsoft 365.

Hybrid Workforce: To support a workforce that moves between the home, the office, and public spaces, FortiSASE delivers consistent security posture . 5 It replaces the inconsistent experience of legacy VPNs with a geographically dispersed network of over 150 Points of Presence (PoPs), ensuring low-latency access to applications while maintaining high-performance SSL inspection and threat detection for all remote users.

Zero Trust Integration: Central to the FortiSASE architecture is Universal ZTNA (Zero Trust Network Access). 7 Unlike traditional VPNs that grant broad network access, ZTNA applies the principle of " never trust, always verify " . It grants access on a per-session, per-application basis, continuously verifying the device posture and user identity before and during application access. 9 This shift from implicit to explicit trust significantly reduces the internal attack surface and mitigates the risk of lateral movement by attackers.

By integrating these components into a single operating system ( FortiOS ) and managed via a single console, FortiSASE simplifies IT operations while delivering the visibility and control required for today ' s multicloud and hybrid environments.

In recent versions of FortiSASE (starting from version 24.4 and later), the platform has increased its scalability to support larger enterprise environments.

Maximum Hub Support : According to the FortiSASE Mature Administration Guide and the FortiSASE 25.3.148 Feature Release Notes , administrators can now configure a maximum of 12 SPA Service Connections (SPA hubs) . Previously, this limit was restricted to 4 hubs.

Scalability for Large Enterprises : This enhancement allows organizations with complex, geographically dispersed networks—such as those with multiple regional datacenters or cloud hubs—to integrate up to 12 distinct FortiGate SD-WAN hubs into their SASE infrastructure.

Service Connection Licensing : Each SPA hub requires a dedicated FortiGate SPA Service Connection license . In MSSP environments using FortiCloud Organizations, a single FortiSASE instance can inherit these licenses from a root OU, supporting up to the same cumulative maximum of 12 service connections.

Routing and Performance : These 12 hubs form the " Private Access " backbone, where FortiSASE security PoPs act as spokes. The use of BGP (either per-overlay or on loopback) ensures that traffic is dynamically routed to the optimal hub based on the destination network and defined SLA priorities.

When deploying FortiSASE agent-based clients, several features are available that are not typically available with an agentless solution. These features enhance the security and management capabilities for endpoints.

Vulnerability Scan:

Agent-based clients can perform vulnerability scans on endpoints to identify and remediate security weaknesses.

This proactive approach helps to ensure that endpoints are secure and compliant with security policies.

SSL Inspection:

Agent-based clients can perform SSL inspection to decrypt and inspect encrypted traffic for threats.

This feature is critical for detecting malicious activities hidden within SSL/TLS encrypted traffic.

Web Filter:

Web filtering is a key feature available with agent-based clients, allowing administrators to control and monitor web access.

This feature helps enforce acceptable use policies and protect users from web-based threats.