FortiSASE

Why do you need FortiSASE?

SASE is what happens to cybersecurity when the office stops being the place where traffic is inspected. The practical question is not which acronyms the platform covers, but whether the policy a remote laptop gets is the same one it would have received in the building.

Access control only works if it follows the user — a laptop at home should get the same policy it would have received in the building. When new locations and groups of remote users arrive as separate projects, and the web gateway, CASB and remote access live in separate tools, gaps open up between them.

FortiSASE is cloud-delivered SASE that combines ZTNA, SWG, CASB and FWaaS in one service. According to Fortinet, it protects users outside the corporate network with the same policies as in the office; it runs on FortiOS, uses FortiGuard services and relies on one FortiClient agent.

How does it work?

Zero Trust Network Access

Access to specific applications instead of the whole network:

• verification of the user and device before every application session,
• device posture re-assessed during access,
• user identity and device context in the policy,
• explicit permissions to named applications,
• an agentless option for web applications, available from a browser.

Secure Web Gateway

Web traffic protection from the cloud:

• URL filtering by FortiGuard categories,
• SSL/TLS inspection, including TLS 1.3,
• antivirus protection and file filtering,
• Safe Search enforcement.

Cloud Access Security Broker

Visibility and control of SaaS applications:

• shadow IT discovery,
• protection of sanctioned SaaS applications,
• data loss prevention (DLP),
• SaaS access only from trusted devices.

Key Features

Firewall as a Service

• NGFW capabilities from the cloud on FortiOS,
• application control, IPS, DNS filtering,
• antivirus protection and sandboxing,
• FortiGuard Labs services.

SD-WAN Integration

• integration with Fortinet Secure SD-WAN and FortiGate,
• application-based traffic steering,
• IPsec tunnels from the PoP to SD-WAN hubs for private applications.

One Agent

• FortiClient for ZTNA, steering traffic to SASE and endpoint protection,
• Windows, macOS, Linux, Android and iOS,
• agentless access for BYOD devices and Chromebooks.

PoP Network

• points of presence (PoPs) with traffic inspection at each location,
• the number of available PoPs depends on the subscription tier,
• a FortiSASE Sovereign option deployed in your own data center.

Security Functions

Secure Internet Access:

• web filtering and threat protection,
• SSL/TLS inspection,
• malware and phishing blocking,
• DNS filtering.

Secure Private Access:

• zero trust access to applications in the data center and the cloud,
• identity-based policies,
• continuous device posture assessment.

Secure SaaS Access:

• inline and API-based CASB,
• DLP for cloud applications,
• shadow IT control.

Who is it for?

• Financial and insurance institutions with hybrid employees
• Organizations with many branches, including branches without a local firewall
• Companies that want to give contractors application access without VPN
• IT teams combining the web gateway, CASB and ZTNA in one console

Benefits

For IT: one agent, one cloud console, optional management from FortiManager

For security: the same policies in the office and outside it, ZTNA, inspection of encrypted traffic

For business: licensing by the number of users

Specifications

Components	ZTNA, SWG, CASB, FWaaS, DLP
Agent	FortiClient (or agentless access)
PoPs	Fortinet network; access depends on subscription
Management	Cloud console, FortiManager

When does FortiSASE make sense for your organization?

FortiSASE makes sense where users and branches are dispersed and traffic no longer passes through a single firewall at headquarters. Below are three typical situations.

Remote employees in a financial institution

An analyst works from home, from a branch and while traveling, and the security team has to show that the laptop follows the same rules as in the office. The FortiClient agent steers traffic to a FortiSASE PoP, where web filtering, SSL/TLS inspection, IPS and DLP run. Access to internal systems goes through ZTNA with a device posture check, and sign-in can rely on a SAML identity provider and FIDO2 keys. Geofencing makes it possible to block connections from countries where nobody in the company works. Logs can be sent to FortiAnalyzer, FortiSIEM or the Fortinet SOCaaS service. According to the data sheet, FortiSASE holds SOC 2 Type II certification, and organizations with data sovereignty requirements can consider FortiSASE Sovereign, run in their own data center.

Branches without a local firewall

A small store in a retail chain or a field office of a plant has no firewall of its own and no administrator on site. FortiSASE treats such locations as a “thin edge”: a FortiAP access point or a FortiBranchSASE device steers the traffic of every device at the site to a PoP, and the cloud console manages them with zero-touch provisioning. Locations with a router from another vendor can connect to a PoP with an IPsec tunnel.

Application access without VPN

A contractor is going to work in a single web application for a few weeks. Instead of a VPN account, they get a link to the agentless ZTNA portal: they sign in through a SAML identity provider in the browser, FortiSASE checks their location (geofencing) and acts as a reverse proxy to that one application. Employees with the FortiClient agent use ZTNA for non-web applications too, through a FortiGate acting as the application gateway. When the engagement ends, disabling the contractor’s account at the identity provider is enough — no VPN client stays on their device.

Which scenario to start with depends on the list of applications and user groups, not on the number of locations.

Why deploy FortiSASE with nFlo?

SASE changes the traffic path of every user, so the project starts with an application map, not with the console. In a FortiSASE project, the nFlo team:

• inventories applications, user groups, branches and current remote access,
• designs SIA, SPA and SaaS policies and the integration with FortiGate and SD-WAN,
• deploys agents and agentless access in stages, group by group,
• maintains policies, security profiles and reports.

FortiSASE is part of the Network Security service. Start a conversation about remote work and branches in your organization through contact; you can read about nFlo’s cooperation with the vendor on the Fortinet page.

FAQ

How does FortiSASE differ from VPN? After sign-in, a VPN gives access to the network. ZTNA in FortiSASE gives access only to named applications and verifies the user and device before every session, re-assessing device posture during access.

Does FortiSASE replace FortiGate? No. FortiSASE protects users outside the corporate network and small locations without a firewall. In a branch with a FortiGate, you can choose local inspection or steer traffic to FortiSASE through FortiGate and Secure SD-WAN.

How does deployment work? Traffic reaches FortiSASE through the FortiClient agent, without an agent (PAC file, proxy, ZTNA portal) or through an IPsec tunnel from a branch. The service is managed from a cloud console; FortiManager can also be used.

How many PoPs are available? Fortinet keeps expanding its PoP network. The number of PoPs that an instance’s users can access depends on the subscription tier and the number of users — we check it when selecting the license.

What is single agent? FortiClient as one SASE agent: ZTNA, steering traffic to FortiSASE, VPN and endpoint protection, instead of separate agents for each task.

How does CASB work? Inline mode controls traffic to SaaS applications and reports shadow IT; API mode connects to SaaS applications and scans stored data and configuration. Both work with DLP.

Can it connect with on-premise FortiGate? Yes. FortiSASE integrates with Fortinet Secure SD-WAN; access to private applications runs through IPsec tunnels from the PoP to SD-WAN hubs, and a FortiGate can act as the ZTNA gateway.

How does SSL inspection work? In deep inspection mode, FortiSASE decrypts traffic at the PoP, inspects the content and re-encrypts it. It covers TLS 1.3 as well as SMTPS, IMAPS and FTPS, among others.

Which applications does ZTNA protect? With the FortiClient agent — internal and cloud applications over TCP and UDP, through a ZTNA gateway on FortiGate. Without an agent — private web applications accessed through a browser.

How does support work? Fortinet provides vendor technical support through FortiCare. nFlo, as a Fortinet Advocate Partner, designs and deploys FortiSASE and plans the migration from VPN.

How does agentless ZTNA work in FortiSASE? A contractor or temporary worker opens a portal with application bookmarks in a browser. FortiSASE authenticates them through a SAML identity provider, checks their geolocation and, as a reverse proxy, grants access to a private web application — without installing an agent.

Can FortiSASE cover a branch without a firewall? Yes. A FortiAP access point or a FortiBranchSASE device works as a LAN extension and steers the traffic of every device at the site to FortiSASE; they are managed from the cloud console.

How is FortiSASE licensed? By the number of users, with access to the SASE capabilities within the subscription; Fortinet also accepts FortiFlex entitlements. The number of available PoPs depends on the subscription tier.