NSE5-SSE-AD-7-6: Fortinet NSE 5 - FortiSASE and SD-WAN 7.6 Core AdministratorDemo

FortiSASE regional-compliance rules let administrators define a country- or region-specific priority order for on-premises VPN gateways and Security PoPs. Clients attempt the listed connections in order, and an unavailable on-premises FortiGate gateway fails over to the next available configured connection, including a Security PoP.

FortiSASE remote-user authentication sources are LDAP, RADIUS, and SSO through a SAML identity provider. These sources authenticate users and can be associated with user groups to control access to FortiSASE resources.

SD-WAN member 1 is out of SLA for the configured Corp_HC health check, leaving member 2 as the only passing member. The SLA-mode rule evaluates members 1 and 2 and forwards through the eligible member; member 2 maps to port2. FortiGate SLA-mode rules select a link that satisfies the configured SLA, using the configured member preference when multiple eligible links exist.

Dedicated IPs at security points of presence provide stable egress source addresses. They support source IP address anchoring and allow geolocation-based access or policy rules to be applied consistently.

FortiClient can be provisioned by distributing the installer to users for manual installation or by using invitation-code-based installers deployed through the FortiSASE portal, SCCM/GPO, or MDM software. Invitation codes enable managed users to be provisioned to connect to FortiSASE; preconfigured installers can include the code, while manual installers require users to enter it.

Digital experience monitoring (DEM) displays SaaS application health-check metrics for connectivity between the geographical FortiSASE points of presence (PoPs) and SaaS applications, enabling performance and connectivity monitoring.

FortiGate uses SD-WAN rules by default only for local-out traffic generated by ping and traceroute. To steer other local-out feature traffic through SD-WAN, configure that feature individually to use SD-WAN; FortiOS exposes per-feature local-out interface-selection settings.

FortiSASE managed endpoint onboarding supports obtaining the FortiClient installer by downloading it directly from the FortiSASE portal or by sending invitation emails to selected users with installer links. The email-based method can provide installers for major operating systems and may use either a preconfigured or manual installer.

FortiSASE supports agent-based Endpoint mode through FortiClient and agentless SWG mode for devices that use explicit web-proxy settings. The available mode depends on the deployment and endpoint requirements.

Site-based remote user internet access routes endpoint traffic through a configured FortiSASE LAN-extension or secure-edge device. Centralizing traffic redirection at that site device avoids configuring each individual endpoint, unlike agentless proxy settings or a FortiClient deployment.

Agentless FortiSASE SIA uses a PAC file to configure browsers or browser-based devices to send HTTP and HTTPS traffic through the FortiSASE secure web gateway as an explicit proxy. This model is suitable for unmanaged endpoints, such as contractor devices, where installing FortiClient is not practical; non-web traffic bypasses the service. Fortinet: SIA for agentless remote users

FortiView is a comprehensive monitoring system that brings real-time and historical data together for analyzing network threats and activity. It supports filtered, consolidated log analysis and presents information in visual and text-based formats.

FortiGate requires SD-WAN member interfaces to provide eligible egress links, routing to direct traffic to the SD-WAN interface or zone, and firewall policies to allow that traffic to be forwarded. SD-WAN rules select the appropriate member for permitted traffic; traffic shaping and security profiles are optional policy features.

The traffic matches the router policy because both its source and destination addresses fall within the configured subnets. A router-policy action of deny means FortiGate does not search the policy-route table; it therefore uses the normal forwarding information base (FIB) routing decision rather than applying the SD-WAN service rule or dropping the traffic.

Scheduled endpoint upgrades use the endpoint’s local time zone. When the endpoint clock has already passed the configured time, FortiClient begins installation on the following day at that configured time. Endpoint upgrade rules apply to computer/device groups or objects rather than user groups, and macOS installations do not require a reboot.

FortiSASE supports API-based CASB and Inline-CASB. API-based CASB performs out-of-band inspection of supported SaaS applications, while Inline-CASB uses Application Control and SSL deep inspection to apply access control to SaaS traffic.

FortiSASE provides centralized visibility and control, consistent cloud-delivered security for off-net users, and improved user experience by avoiding the latency and performance degradation associated with backhauling traffic through a traditional firewall and full-tunnel VPN. Fortinet identifies unprotected direct Internet access, inconsistent endpoint security posture, and VPN-backhauling congestion and latency as work-from-anywhere challenges.

FortiSASE can automatically patch eligible detected vulnerabilities when automatic patching is enabled in the endpoint profile. Its Vulnerability Summary widget lets administrators drill down from vulnerability categories or severity levels to view vulnerability details, including CVE information and severity classifications.

FortiSASE Geofencing supports allowing or denying remote-user and edge-device connections to FortiSASE security points of presence (PoPs) according to the country or region where the connection originates.