I85PREP
⌘ K
FCSS FortiSASE 25 Administrator study materials
FCSS FortiSASE 25 Administrator study resources

FCSS FortiSASE 25 Administrator: Secure Private Access and SD-WAN Integration

FCSS FortiSASE 25 Administrator · Work through your exam, one topic at a time.

All guide sections

Secure Private Access and SD-WAN Integration

Domain 2: Secure Private Access and SD-WAN Integration

This domain tests private application access through FortiSASE and branch connectivity where FortiSASE acts as an SD-WAN hub. You must know the connector path, the policy objects that authorize access, and how multiple WAN links and routes are selected.

Core rules

  • Private access is connector-based. A FortiGate (or supported connector) at the private site builds an IPsec tunnel to the FortiSASE PoP. The PoP forwards only traffic that matches a private network and an access rule; it is not a general router into your LAN.
  • Define private networks as CIDRs and applications as FQDN/IP plus port. ZTNA/access rules bind user or group, and optionally device posture/tag, to an application. Default is deny.
  • Client-based private access uses the FortiSASE client; agentless browser access can cover web applications. Private DNS must resolve to the address reachable through the tunnel, or split DNS must send the private zone to the right resolver.
  • SD-WAN integration: a branch FortiGate with multiple WAN links builds an IPsec overlay per link to one or more FortiSASE PoPs. BGP exchanges routes, and health checks/SLA steer traffic over the best overlay. FortiSASE is the hub; the branch is the spoke.
  • Avoid overlapping private subnets across connectors. Summarize carefully and do not advertise a default route into the private-access BGP session unless you intend to attract all traffic.

Worked example

A branch uses 10.20.0.0/16 and has two ISPs. The CRM is 10.20.10.10:443 and only Finance should reach it. The administrator configures a connector at the data center, defines private network 10.20.0.0/16 and application CRM-443, then creates a ZTNA rule Finance -> CRM-443. On the branch FortiGate, two IPsec overlays and BGP are configured, with an SLA health check to 10.20.10.10. A Finance user's client connects to the nearest PoP and the CRM resolves to the private address; the rule matches and traffic traverses the connector tunnel.

Reasoning: the private network makes the prefix reachable; the application and rule authorize it; BGP and SLA choose the path.

Traps

  • Creating a private network but no access rule, or a rule but no route.
  • Overlapping 10.0.0.0/8-style subnets between connectors.
  • Forgetting the return route on the connector FortiGate.
  • Letting public DNS resolve a private FQDN to a public address.
  • Assuming SD-WAN works without health checks or that BGP advertises automatically.

Key points

  • Private access requires a connector tunnel, private network definition, and matching access rule.
  • ZTNA rules bind user/group and optional device posture to a private application.
  • Private DNS must resolve to the tunnel-reachable address or split DNS must be correct.
  • SD-WAN uses multiple IPsec overlays, BGP, and SLA health checks to select a path to FortiSASE.
  • Overlapping private subnets and default-route leaks break private access.