Retail PCI Segmentation With Local SASE Breakout

Local breakout with SASE fits better, but only with strict segmentation. Backhauling 240 stores to a data center adds latency to cloud POS and wastes WAN capacity; the stores already have dual broadband and 4G, so the physical path exists. Use the FortiGate as a thin edge on-ramp to FortiSASE for guest and approved cloud traffic, while keeping POS in a dedicated VLAN with an allowlist to the payment provider. Guest Wi-Fi should break out locally through FortiSASE SWG with no route to POS or back-office networks. The PCI judgement is not “breakout versus no breakout”; it is whether cardholder data can cross untrusted paths. If POS traffic is encrypted to the provider and the store cannot inspect it, restrict egress by destination and application, deny all other POS-initiated traffic, and log flows. A central SSE design would simplify policy but would not fix latency and would concentrate failover risk. The design should be piloted in 10 stores with representative broadband quality before scaling.

Treat 4G as a managed SD-WAN member, not as a separate untrusted path. Attach the same FortiSASE IPsec tunnel and security policy to the 4G interface, with SD-WAN health checks and SLA rules that prefer broadband but allow 4G when latency and loss exceed thresholds. Keep POS egress allowlisted and identity-independent, but require the same FortiSASE inspection where the traffic is inspectable; if the payment flow uses pinned TLS, preserve the destination restriction and log the exception. For guest, either keep guest off 4G entirely or apply a low-bandwidth queue and captive portal, because guest video can exhaust a metered link and starve POS. Use hysteresis so a brief brownout does not flap all traffic to 4G. Test by physically disabling both broadband links in a pilot store and confirming that POS still reaches only the provider, guest cannot reach POS, and FortiAnalyzer records the path change. The judgement is to accept reduced performance on 4G while refusing to accept a different security policy on 4G.

Provide flow-based evidence, not a network diagram alone. Show the POS VLAN’s permitted egress list, the default-deny rule, and logs proving that guest and back-office subnets cannot initiate sessions to POS. Show FortiSASE and FortiGate policy hits for POS-to-payment-provider traffic, including the 4G failover case. Show that local breakout does not advertise POS routes to guest or to the internet, and that DNS for POS is restricted. Include change records for the FortiManager template and a sample of store configuration drift checks. Also document any uninspected TLS flow, why it is unavoidable, and the compensating controls: destination allowlist, endpoint hardening, and logging. The reasoning is that PCI segmentation is proven by denied paths and restricted egress, not by claiming that SASE inspects everything. If the assessor requires full inspection of cardholder traffic, the design must either terminate TLS at a controlled point or keep that flow out of local breakout.