In a FortiSASE Secure Internet Access (SIA) deployment utilizing the FortiClient agent, traffic steering and routing are managed via the endpoint profile. To direct specific internet traffic—such as Google Maps—out of the endpoint's local physical network interface rather than through the FortiSASE VPN tunnel, split tunneling must be utilized. FortiSASE allows administrators to define split tunneling exclusions directly within the endpoint profile using Fully Qualified Domain Names (FQDNs), IP addresses, subnets, or Internet Service Database (ISDB) objects. By configuring the Google Maps FQDN as a split tunneling destination, the FortiClient dynamically injects local routes to ensure that specific domain traffic bypasses the inspection tunnel.

A: System proxy exemptions apply strictly to Secure Web Gateway (SWG) explicitly proxied environments, not to the VPN tunnel-based traffic routing shown in the exhibit.

B: Operating systems generally do not support static routing directly via FQDNs. This dynamic routing must be handled by the FortiClient agent via the split tunnel configuration.

D: Changing DNS server configurations alters how domain names are resolved but does not dictate the physical or virtual routing path the resulting IP traffic will take.

Fortinet. (2023). FortiSASE Administration Guide: Endpoint Profile. Section: Configuring split tunneling. Retrieved from Fortinet Document Library (https://www.google.com/search?q=docs.fortinet.com).

Fortinet. (2023). FortiSASE Architecture Guide. Section: Traffic Steering and Secure Internet Access (SIA). Retrieved from Fortinet Document Library (https://www.google.com/search?q=docs.fortinet.com).