The unified FortiClient is the FortiSASE endpoint agent installed on remote user devices. It is designed to establish a persistent, "always-on" secure tunnel (VPN) to the nearest FortiSASE Point of Presence (PoP). This ensures that the endpoint is always connected and all its traffic is routed through the SASE security stack for inspection and policy enforcement, regardless of the user's physical location. This directly facilitates the requirement for endpoints to be always connected and protected.

A. site-based deployment: This method connects a fixed physical site, such as a branch office, to FortiSASE using a FortiGate appliance, not individual remote user endpoints.

B. thin-branch SASE extension: This is a specific type of site-based deployment for smaller branches, often using a FortiExtender. It does not apply to individual remote users.

D. inline-CASB: This is a security service for monitoring and controlling access to cloud applications. It is a function applied to traffic, not the component that establishes the endpoint's connection.

1. Fortinet FortiSASE Administration Guide: In the "Remote users" section

it states

"FortiSASE secures remote users using the FortiClient endpoint agent... FortiClient establishes a secure tunnel to the nearest FortiSASE PoP." The guide also details the configuration of "Always-on VPN" for FortiClient profiles. (Reference: FortiSASE Administration Guide > Remote users > FortiClient).

2. Fortinet FortiSASE Datasheet: The datasheet describes the two primary modes of connectivity: "securing remote users with a client" and "securing edges (sites)." It explicitly identifies FortiClient as the component for securing remote users. (Reference: FortiSASE Datasheet

"Comprehensive SASE Solution" section).

3. Fortinet Docs - FortiSASE Architecture Guide: This guide outlines the core components

showing FortiClient as the agent for endpoints connecting to the FortiSASE cloud-delivered security services. (Reference: FortiSASE Architecture Guide > Architecture > Components).