FortiExtender can be connected to FortiSASE as a LAN extension for a thin branch using two primary methods. The first is an automated, zero-touch process using FortiZTP, where the device automatically discovers and connects to the FortiSASE service upon being powered on. The second is a manual method where an administrator logs into the FortiExtender's GUI and explicitly configures the FortiSASE domain name (fortisase.com) as the static discovery server, which initiates the connection process.

B. Enable Control and Provisioning Wireless Access Points (CAPWAP) access on the FortiSASE portal: CAPWAP is a protocol for managing access points from a controller; it is not used for connecting the FortiExtender device itself to FortiSASE.

D. Configure an IPsec tunnel on FortiSASE to connect to FortiExtender: While the underlying connection is an IPsec tunnel, the administrator does not manually configure it on the FortiSASE portal. The tunnel configuration is automated via the ZTP or manual discovery process.

1. FortiSASE Administration Guide, Version 23.3, "Secure Internet Access > Thin Edge > FortiExtender as a SASE LAN extension". This section explicitly states: "You can connect a FortiExtender to FortiSASE using FortiZTP or by manually configuring the FortiExtender."

2. FortiSASE Administration Guide, Version 23.3, "Secure Internet Access > Thin Edge > FortiExtender as a SASE LAN extension > Manually connecting a FortiExtender". This section details the manual process: "In the FortiExtender GUI...For Type, select FortiSASE. For Server, enter fortisase.com."