FortiSASE includes a built-in geofencing feature that evaluates the public IP address of a registering FortiClient. By defining allowed or blocked countries, the administrator can prevent endpoints located in those geographies from establishing the tunnel to any FortiSASE point-of-presence (PoP). The control is applied before FortiClient registration is completed, thereby fulfilling the requirement to “restrict endpoints from certain countries from connecting to FortiSASE.”

A. Network-lockdown only isolates the endpoint’s local network access; it does not examine the source country of a connection to FortiSASE.

B. Source IP anchoring fixes a user’s traffic to a selected PoP, not to country-based admission control.

C. Geography address objects work inside FortiSASE firewall policies—after a tunnel exists—so they cannot stop the initial connection.

1. Fortinet. “FortiSASE for Remote Users – Administration Guide v23.3,” Section “Geofencing,” pp. 62-64.

2. Fortinet KB Article #FD55792, “Using geofencing to allow or block FortiClient connections,” para. 2-3 (2023).