The FortiClient Administration Guide states that on-net rules determine when an endpoint is in a trusted location. If the endpoint matches the configured subnet, the client is considered on-net, and therefore bypasses auto-connect.
"Device registration and on-net status information for a device that is running FortiClient appears only on the FortiGate that applies the FortiClient profile to that device." Since 192.168.13.101 falls inside the trusted subnet 192.168.13.0/24, the endpoint is treated as on-net # it will be exempted from auto-connect.

In FortiSASE, the recommended method to upgrade FortiClient is to configure an endpoint upgrade rule and assign it to specific endpoint groups. This ensures controlled and automated upgrades across managed devices.

The self-registration portal is the recommended method for granting temporary internet access to contractors or guests. It provides a simple and secure way for the contractor to authenticate and access the internet without requiring full endpoint management or policy configuration.

The Digital Experience Monitoring (DEM) agent on the endpoint performs a trace route to the SaaS application to measure latency, packet loss, and hop-by-hop performance. This helps diagnose where in the path connectivity or performance issues are occurring.