FCSS FortiSASE 25 Administrator key terms

A cloud-delivered architecture that merges network security services such as secure web gateway, firewall, and data loss prevention with WAN connectivity, so users are protected wherever they connect instead of only at a branch office.

A dedicated cloud tenant provisioned for an organization, holding its own configuration, policies, users, and logs. Administrators reach it through the FortiCloud portal, and its region determines where traffic is inspected and data is stored.

The geographic location selected at provisioning time that hosts the tenant and its points of presence. It affects user latency, data residency compliance, and which public egress addresses remote sites and endpoints will appear to use.

A cloud location where FortiSASE terminates tunnels and inspects traffic. Users and branches are steered to the nearest one, so security enforcement happens close to them rather than backhauling traffic to a central data center.

The public source address that FortiSASE presents to the internet after inspecting traffic. Third-party services often require allowlisting it, and it differs by point of presence, so all possible egress ranges must be registered.

The identity mechanism used to log in to the FortiSASE portal and to link the tenant with FortiCloud assets such as FortiClient EMS and FortiManager. Account roles determine which administrators can modify which objects.

A permission template assigned to a portal account that limits which sections and actions an administrator can use, such as read-only log access versus full policy editing. It supports least-privilege delegation across teams.

An exported copy of the tenant configuration that can be restored or used to compare changes between maintenance windows. It is a safeguard before bulk policy edits, firmware upgrades, or large onboarding projects.

A scheduled period during which the cloud service applies a new software release to the tenant. Administrators pick the timing to limit disruption, and should review release notes and back up configuration beforehand.

A record of administrative actions in the portal, including who changed a policy, when, and from where. It is the primary evidence source when investigating unexpected configuration drift or a security incident involving admin accounts.

An encrypted site-to-site connection between a branch FortiGate and a FortiSASE point of presence. It carries private and internet-bound traffic from the site so remote offices receive the same cloud security policy as roaming users.

The FortiSASE capability that connects users and branches to internal applications and networks over encrypted tunnels. It replaces traditional remote-access VPN concentrators with cloud-brokered connectivity and per-application access control.

A dynamic routing session established over an IPsec tunnel between a branch FortiGate and FortiSASE. It advertises private subnets into the cloud and lets the service learn which destinations should be reached through that site.

A manually defined path used instead of BGP when the private subnets reachable through a branch tunnel are few and stable. It requires updating whenever internal addressing changes, so it is common in small deployments.

A probe that monitors whether an IPsec or SD-WAN link is usable, based on latency, jitter, and packet loss thresholds. Failed probes trigger failover or mark the site as unreachable in the portal.

A policy that selects which WAN link or overlay path traffic should use, based on application identity and measured link quality. In FortiSASE integration it lets branches prefer a healthy path toward the cloud.

The performance thresholds, such as maximum latency and loss, that a link must meet to be considered in compliance. SD-WAN rules compare live measurements against it to choose or reject a path.

The cloud-side configuration object that represents a branch FortiGate joined to FortiSASE, including its serial number, tunnel settings, and advertised networks. It is the anchor for site-level secure private access.

The FortiSASE service that inspects traffic destined for the public internet. It applies web filtering, antivirus, intrusion prevention, and application control to remote users and branch traffic before allowing outbound connections.

A reusable set of category and URL decisions, such as block for gambling and allow for business, applied to user traffic. It can also enforce safe search, rate limits, and warnings before a page loads.

A classification assigned to websites by FortiGuard Labs, covering topics like phishing, malware, and streaming. Policies reference categories rather than individual domains so coverage updates automatically as the database changes.

An explicit allow, block, or monitor entry for a specific domain, hostname, or pattern within a web filter profile. It is used for exceptions that category-based decisions cannot express, such as a sanctioned vendor portal.

A temporary exception that lets a specific user or group reach a blocked site after authentication and, optionally, justification. Administrators review override activity in logs to detect misuse or to tune categories.

Security applied at the domain-resolution layer, blocking malicious or disallowed domains before a connection is made. It protects users even when traffic is not inspected, and it can redirect lookups to a safe response page.

A resolver service used by FortiSASE clients and branches so lookups are filtered and encrypted in transit. It prevents users from bypassing policy by pointing devices at an unfiltered public resolver.

The process of decrypting TLS traffic so content-based engines can examine it, then re-encrypting before delivery. Profiles decide which categories are inspected and which are exempted to protect privacy and certificate pinning.

A lightweight form of SSL handling that reads the server certificate and SNI to identify the destination without decrypting payload. It supports category-based blocking but cannot detect malware hidden inside an encrypted session.

Full TLS decryption that exposes request and response content to antivirus, intrusion prevention, and data loss prevention engines. It requires a trusted inspection CA certificate on endpoints, otherwise users see browser certificate warnings.

The certificate authority certificate that FortiSASE presents when decrypting sessions. It must be distributed to managed endpoints as trusted, typically through a configuration profile, so re-signed sites are accepted without warnings.

A rule that skips decryption for specified categories, domains, or applications, such as banking or healthcare sites. Exemptions reduce breakage and legal risk but leave that traffic unexamined by content engines.

A configuration that defines which protocol streams are scanned for malware and what action is taken, such as block or quarantine. It covers web downloads, email attachments, and file transfers depending on enabled protocols.

A collection of intrusion prevention signatures and anomaly rules with severity-based actions. It detects exploitation attempts and policy violations in network traffic and can reset or block the offending session.

Identification and policy enforcement for applications regardless of port or encryption, using signature and behavior detection. It lets administrators allow sanctioned apps, block shadow IT, and shape bandwidth by application.

The endpoint management server that deploys FortiClient profiles, distributes the inspection certificate, and reports endpoint compliance to FortiSASE. It is the usual integration point for managing large fleets of roaming devices.

The endpoint agent, based on FortiClient, that establishes the secure tunnel to the nearest point of presence and enforces ZTNA and web policy. Its version and profile determine which protections are active on a device.

A client setting that keeps the secure tunnel up whenever the device has connectivity, blocking traffic if the tunnel drops. It prevents users from working unprotected on untrusted networks such as public Wi-Fi.

A configuration that sends only selected traffic through the FortiSASE tunnel while other destinations go directly. It reduces cloud load and latency but can create inspection gaps if excluded traffic is sensitive.

Zero Trust Network Access grants application-level connectivity only after verifying user identity, device posture, and policy, without placing the device on the network. Applications stay hidden from unauthorized users.

A published internal resource, such as a web app or server, that users reach through ZTNA rather than a broad network tunnel. Each entry defines its address, port, and the groups permitted to connect.

The cloud component that terminates user connections for a ZTNA application and forwards them to the private resource. It enforces authentication and policy at the application boundary instead of the network edge.

A lightweight agent deployed inside the private network that maintains an outbound connection to FortiSASE and relays ZTNA traffic to internal applications. It avoids inbound firewall openings and public exposure.

A set of checks on an endpoint, such as OS patch level, disk encryption, antivirus status, and domain membership, evaluated before granting access. Failing posture can trigger remediation or denial.

A rule that evaluates endpoint attributes reported by the client and assigns a compliant or non-compliant tag. Policies then use those tags to allow, restrict, or quarantine the device.

Registration of a device with a mobile device management system so profiles, certificates, and VPN settings are pushed automatically. It reduces manual setup and ensures the inspection CA is trusted before users browse.

A collection of identities imported from an identity provider or defined locally, used as the matching criterion in firewall, web filter, and ZTNA policies. Group membership drives which policy a session receives.

A per-session record showing source, destination, applied policy, action, bytes, and the security profiles that fired. It is the first place to look when a user reports a site blocked or an application failing.

Sending FortiSASE logs to an external destination such as FortiAnalyzer, a SIEM, or cloud storage. It supports long retention, correlation with other sources, and compliance requirements beyond the portal's built-in retention.

A troubleshooting tool that simulates a session's attributes and reports which policy route, firewall policy, and profiles would apply. It shortens diagnosis when actual traffic behaves differently than expected.

A recorded sample of traffic taken at a tunnel or interface for protocol-level analysis. It is used when logs are inconclusive, for example to confirm whether a handshake reaches FortiSASE or fails earlier.