NSE7-SSE-AD-25: Fortinet NSE 7 - FortiSASE 25 Enterprise AdministratorDemo

The BGP Peer IP must be the IP address used as the BGP peer ID on the FortiGate hub. SPA uses BGP over its IPsec overlays to exchange routes between security PoPs and the networks behind the hub; therefore, an incorrect peer IP can cause service-connection routing failures even when the underlying tunnel is up. Fortinet documents this setting as the hub IP address used as the BGP peer ID.

Security posture tags identify endpoint conditions and can be used in dynamic ZTNA policy rules. They enable access decisions to be applied according to device security posture or compliance context, providing granular control over application access.

A FortiGate ZTNA access proxy terminates the secure client connection and proxies TCP traffic to protected resources, allowing FortiGate to process that traffic. ZTNA server definitions and ZTNA policies are required configuration components of the FortiGate ZTNA application gateway and enforce access using endpoint identity and security-posture context.

Enabling SSO in FortiSASE overrides previously configured user-authentication methods, such as local authentication and RADIUS.

FortiSASE geofencing can block remote user connections initiated from specified countries or regions. A country included in the Deny specified list prevents an agent-based VPN tunnel from being established even when SSO authentication succeeds and the relevant firewall policies and ZTNA tags are valid.

FortiSASE ZTNA uses the FortiGate ZTNA access-proxy traffic flow, so endpoint traffic goes directly to the ZTNA access proxy rather than through a FortiSASE PoP. SD-WAN SPA uses FortiSASE security PoPs as spokes, with IPsec connectivity to FortiGate SD-WAN hubs; traffic therefore travels from the endpoint to a FortiSASE PoP and then to the SPA hub.

A Branch On-ramp uses IPsec connections from supported branch devices, including FortiGate and third-party IPsec devices, and a branch device can connect to multiple on-ramp locations. Deep SSL inspection for site-based users requires the FortiSASE certificate authority certificate to be installed on endpoints. The BGP configuration is shared by the Branch On-ramp and Secure Private Access (SPA) features.

FortiSASE schedules can be assigned to firewall policies to limit when matching traffic is processed. A scheduled allow policy, active only during the lunch-break window and using the required security profile, enforces time-based internet access while the policy is inactive during class periods.

A FortiGate ZTNA access proxy verifies synchronized ZTNA tags to perform the endpoint posture check. Agent-based FortiSASE ZTNA also sends the private-application connection directly to the FortiGate access proxy, providing a shortest path that improves performance for latency-sensitive applications.

FortiSASE Secure Private Access (SPA) secures remote-user access to private TCP- and UDP-based applications through FortiGate hubs and the networks behind them. The SPA add-on is therefore the add-on that enables access to private resources.

When no regional compliance rule is selected, FortiClient attempts to connect to the closest FortiSASE security PoP. A regional compliance connection can use either an on-premises device or a security PoP. Connection attempts follow the administrator-defined priority order, rather than an always-fixed order that puts a security PoP first. ოფიციալ Fortinet documentation: https://docs.fortinet.com/document/fortisase/25.3.67/mature-administration-guide/869018/geofencing

Digital experience monitoring provides per-user experience and performance telemetry that can reveal endpoint or network conditions causing an isolated connectivity issue. Citrix documentation describes user-experience monitoring as identifying network-connectivity issues and providing performance insights.

FortiSASE provides cloud-delivered security and policy control for cloud and SaaS access, secure access for hybrid users, and zero-trust capabilities such as ZTNA. These functions address multicloud/SaaS adoption, hybrid-work access, and zero-trust requirements together.

FortiSASE supports forwarding all traffic and event logs to SOCaaS for continuous managed monitoring. SOCaaS analyzes and triages alerts, escalates verified threats, provides dashboards, and delivers 24x7x365 service with Fortinet security experts supported by AI-driven alert triage.

FortiSASE submits all files executed from removable media, including USB drives, for FortiSandbox analysis when that option is enabled. Sandbox functionality applies to endpoints using the relevant endpoint profile and requires Sandbox Detection to have been enabled during FortiClient installation. A Medium quarantine threshold also applies to Medium-or-higher verdicts, not exclusively Medium verdicts.

FortiSASE software-installation inventory provides application details including the application name, vendor, installed version, and detection and installation dates. Administrators can use these details to identify unwanted software or applications that may be outdated.

FortiAP supports FortiSASE microbranch deployments, providing secure internet access for multiple Wi-Fi clients through a centrally managed edge device. This avoids deploying and configuring a FortiClient agent on every personal laptop and mobile device.

FortiSASE central management requires a supported FortiManager model and firmware version, and the FortiManager used for central management must be registered to the same FortiCloud account as FortiSASE.

Allow local LAN access permits remote users to reach resources on their local LAN, such as printers and file shares, while they remain connected to the FortiSASE Cloud Security tunnel. Local-resource traffic is routed through the endpoint’s physical adapter rather than the VPN tunnel.

FortiSASE Secure Private Access supports bidirectional traffic between FortiSASE-connected users and private resources behind FortiGate SD-WAN hubs, including agent-based user-to-resource and resource-to-agent-based-user flows. It also supports Thin Edge and Branch On-ramp traffic to private resources. Internet-bound traffic is handled by Secure Internet Access rather than SPA, and SPA is not a general private-resource-to-private-resource transit service.

FortiSASE forwards its traffic and event logs to SOCaaS, where security events are centrally analyzed, triaged, and escalated as verified threats. The managed service operates continuously, providing ongoing threat monitoring and centralized visibility into detected threat events.

Digital Experience Monitoring displays SaaS-application health and connectivity metrics between the FortiSASE security PoPs provisioned for an instance and the monitored SaaS applications. It provides visibility into connectivity performance along that path, including the ability to identify PoP-to-SaaS connectivity issues.

A home user whose public IP does not match the office public IP rule is off-net. Enabling Allow local LAN access when endpoint is off-net routes traffic for local LAN resources, including printers, through the endpoint’s physical network adapter rather than the FortiSASE SIA tunnel.