The Secure Web Gateway (SWG) policy is used to control traffic between the FortiClient endpoint and FortiSASE for secure internet access. SWG provides comprehensive web security by enforcing policies that manage and monitor user access to the internet.
* Secure Web Gateway (SWG) Policy:
* SWG policies are designed to protect users from web-based threats and enforce acceptable use policies.
* These policies control and monitor user traffic to and from the internet, ensuring that security protocols are followed.
* Traffic Control:
* The SWG policy intercepts all web traffic, inspects it, and applies security rules before allowing or blocking access.
* This policy type is crucial for providing secure internet access to users connecting through FortiSASE.
References:
FortiOS 7.6 Administration Guide: Details on configuring and managing SWG policies.
FortiSASE 23.2 Documentation: Explains the role of SWG in securing internet access for endpoints.

The integration of FortiGuard SOCaaS with FortiSASE significantly strengthens an organization's security posture by offloading complex security operations to Fortinet's expert analysts.4
* Continuous Threat Monitoring (B): FortiGuard SOCaaS provides 24x7x365 threat monitoring for all endpoints connected to the FortiSASE environment. This service eliminates the need for organizations to hire and maintain their own round-the-clock security operations staff while ensuring that threats are detected and verified in as little as 15 minutes.
* Centralized Visibility (C): By forwarding FortiSASE logs to the SOCaaS cloud, administrators gain centralized visibility of all security events through a single, user-friendly portal. This portal allows security teams to track threats, review expert-led incident escalations, and communicate directly with Fortinet SOC analysts to streamline the incident response process.
* Operational Efficiency: The integration uses AI-driven alert triage and automated correlation to distill data from the Fortinet Security Fabric, focusing on legitimate threats and reducing the alert fatigue often experienced by internal IT teams.

In a FortiSASE environment, the ability of a remote user to establish a VPN tunnel is governed not only by their credentials and firewall policies but also by geographic access controls.
* Geofencing Mechanism: FortiSASE includes a Geofencing feature (found under Configuration > Restrictions or Configuration > Geofencing in newer versions) that allows administrators to restrict or allow access to SASE services based on the geographic location of the endpoint's public IP address.
* Connection Failure vs. SSO Success: The scenario describes a situation where users can successfully authenticate via SSO to reach third-party SaaS apps like Office 365 (O365) or Salesforce (SFDC) but cannot connect to the SASE VPN. This occurs because the SSO authentication is handled directly by the Identity Provider (IdP) (e.g., Microsoft Entra ID), which may not have the same geographic restrictions. However, when the FortiClient attempts to establish the tunnel to the FortiSASE Point of Presence (PoP), the SASE gateway checks the Geofencing list. If the country the user is visiting is on the Deny list (or not on the Allow list), the connection is dropped at the "local-in" policy level on the SASE backend, preventing the tunnel from forming.
* Verification and Resolution: To resolve this, the administrator must verify the Geofencing settings and ensure that the countries where the traveling users are located are permitted to connect. If the feature is enabled with a "Deny" list, the specific country must be removed from that list; if it uses an
"Allow" list, the country must be added.
* Analysis of Other Options:
* Option A: Firewall policies govern traffic after the tunnel is established; they cannot resolve a failure to connect the tunnel itself.
* Option B: Restarting the device is a general troubleshooting step but will not bypass a server- side geographic block.
* Option D: While keeping clients updated is a best practice, the issue described (specific to overseas travel while other functions work) points to a configuration restriction rather than a software bug.

The Secure Internet Access (SIA) use case that minimizes individual workstation or device setup is SIA for agentless remote users. This use case does not require installing FortiClient on endpoints or configuring explicit web proxy settings on web browser-based endpoints, making it the simplest and most efficient deployment.
* SIA for Agentless Remote Users:
* Agentless deployment allows remote users to connect to the SIA service without needing to install any client software or configure browser settings.
* This approach reduces the setup and maintenance overhead for both users and administrators.
* Minimized Setup:
* Without the need for FortiClient installation or explicit proxy configuration, the deployment is straightforward and quick.
* Users can securely access the internet with minimal disruption and administrative effort.
References:
FortiOS 7.6 Administration Guide: Details on different SIA deployment use cases and configurations.
FortiSASE 23.2 Documentation: Explains how SIA for agentless remote users is implemented and the benefits it provides.

The core of this issue lies in the difference between Certificate Inspection and Deep SSL Inspection within the FortiSASE security framework.
* The Limitation of Certificate Inspection: When "Force Certificate Inspection" is enabled in a FortiSASE firewall policy, the system only inspects the SSL handshake-specifically the SNI (Server Name Indication) and certificate headers. It does not decrypt the actual data payload of the HTTPS session.
* Antivirus Scanning Requirements: To detect and block malicious files like the EICAR test file when they are downloaded over an encrypted HTTPS connection (such as https://eicar.org), the FortiSASE antivirus engine must be able to "see" inside the encrypted tunnel. This requires Deep Inspection (Full SSL Inspection), where FortiSASE acts as a "man-in-the-middle" to decrypt, scan, and then re-encrypt the traffic.
* Exhibit Analysis: The Secure Internet Access policy exhibit clearly shows the toggle for Force Certificate Inspection is enabled (set to "ON"). As specified in the Fortinet technical documentation, enabling this option forces the policy to use Certificate Inspection only, overriding any Deep Inspection settings that might be defined in the Profile Group.
* Conclusion: Because the traffic is only undergoing certificate-level inspection, the antivirus engine cannot analyze the encrypted eicar.com-zip file payload, allowing the download to proceed even though an antivirus profile is active in the group.