The VPN diagnostic output from the FortiGate hub (Exhibit 1) shows that Phase 2 is established, but the hub has only decrypted 3 packets (dec:pkts/bytes=3/120). This extremely low count indicates that the FortiSASE spoke is not forwarding the user's ICMP traffic into the IPsec tunnel. In FortiSASE Secure Private Access (SPA) architectures, dynamic routing via BGP over the IPsec tunnel is required to advertise hub subnets to the SASE nodes. If FortiSASE does not receive the BGP route for the webserver's destination subnet, it cannot route the ping traffic toward the hub. Exhibit 2 confirms the firewall policy explicitly allows ICMP, meaning routing is the point of failure.

A: The FortiSASE Secure Private Access policy exhibit explicitly shows the configured Service is set to ALL_ICMP, which natively permits ping traffic.

B: The diagnostic output shows src: 0.0.0.0-255.255.255.255 and dst: 0.0.0.0-255.255.255.255. These are universal wildcard selectors (0.0.0.0/0) that do not restrict any subnet traffic.

D: If NAT were the missing component, the packets would still route into the tunnel, meaning the hub's decrypted packet count (dec:pkts) would be actively incrementing rather than stuck at 3.

Fortinet, Inc. FortiSASE Administration Guide: Secure Private Access (SPA) Hub configuration. (Section: Configuring BGP routing for SPA). Details the requirement of BGP peering over IPsec dial-up interfaces to exchange routes between the FortiGate hub and FortiSASE security PoPs.

Fortinet, Inc. FortiOS CLI Reference. (Section: diagnose vpn tunnel list). Explains the interpretation of IPsec tunnel statistics, specifically that dec:pkts represents inbound ESP packets decrypted by the local gateway.

When Single Sign-On (SSO) is enabled on FortiSASE, all users are authenticated exclusively by the external identity provider; FortiSASE automatically disables or ignores local, RADIUS, or MFA settings that were configured earlier.

A. Local users are ignored once SSO is active.

C. RADIUS is bypassed when SSO is enabled.

D. MFA tied to local/RADIUS accounts is not consulted after SSO takeover.

1. FortiSASE for Remote Users Administration Guide 23.4, “Configuring SSO” – note: “SSO overrides any other user authentication method.”

2. Fortinet KB Article FD56069, “SSO precedence in FortiSASE,” para 1.

For a contractor working within the HQ office using a personal device, installing a full VPN client is often undesirable. FortiSASE can function as an explicit web proxy, providing Secure Web Gateway (SWG) services. By configuring the contractor's browser with a Proxy Auto-Configuration (PAC) file, their web traffic can be securely directed to FortiSASE for inspection and policy enforcement without requiring an agent. This method is ideal for providing temporary, secure internet access to guest or unmanaged endpoints on a corporate network.

B. A tunnel policy is for remote access users connecting via FortiClient VPN, not for users already on the corporate network needing internet access.

C. ZTNA is designed for secure access to specific private applications, not for providing general, secure internet access.

D. A self-registration portal is for user onboarding or guest network access, but the underlying security mechanism for internet traffic would still be SWG/proxy.

Fortinet. (2024). FortiSASE Architecture Guide 24.1. "Secure Web Gateway". p. 11. This section describes agentless access using a PAC file to direct browser traffic to FortiSASE for SWG inspection.

Fortinet. (2024). FortiSASE Administration Guide 24.1. "Explicit web proxy". p. 158. This section details how to configure FortiSASE as an explicit proxy and use PAC files for client configuration.

FortiSASE includes a built-in geofencing feature that evaluates the public IP address of a registering FortiClient. By defining allowed or blocked countries, the administrator can prevent endpoints located in those geographies from establishing the tunnel to any FortiSASE point-of-presence (PoP). The control is applied before FortiClient registration is completed, thereby fulfilling the requirement to “restrict endpoints from certain countries from connecting to FortiSASE.”

A. Network-lockdown only isolates the endpoint’s local network access; it does not examine the source country of a connection to FortiSASE.

B. Source IP anchoring fixes a user’s traffic to a selected PoP, not to country-based admission control.

C. Geography address objects work inside FortiSASE firewall policies—after a tunnel exists—so they cannot stop the initial connection.

1. Fortinet. “FortiSASE for Remote Users – Administration Guide v23.3,” Section “Geofencing,” pp. 62-64.

2. Fortinet KB Article #FD55792, “Using geofencing to allow or block FortiClient connections,” para. 2-3 (2023).

For full SSL deep inspection, FortiSASE performs a man-in-the-middle re-encryption process and therefore must act as a certificate authority. It generates a self-signed (or internal PKI-signed) root CA certificate that administrators distribute to all endpoint trust stores; only after the root certificate is trusted can FortiSASE present forged site certificates and decrypt HTTPS, allowing all security profiles—including web filtering, antivirus, application control, and file inspection—to examine the plaintext.

A – FortiSASE must be trusted by endpoints; third-party CA use without import is impossible for MITM.

B – A root or intermediate CA certificate is mandatory.

C – SSL inspection supports all content-inspection profiles, not just antivirus/file filter.

1. FortiSASE Administration Guide v23.4, “SSL/TLS Deep Inspection”, pp. 90-92.

2. FortiOS 7.4 SSL Inspection Handbook, “Distributing the SASE root CA”, §4.2.

3. Fortinet NSE7 SSE-AD courseware, Module 5 lab manual, Step 3 “Export and install SASE CA”.