Unified SASE: One Policy and Context Across Cloud and Edge
Unified SASE is the first domain and tests whether you can reason about Fortinet's convergence of cloud-delivered security and networking under a single policy and context model. The exam is less about reciting product names than about explaining where policy is authored, where it is enforced, and how identity follows a user from a branch FortiGate through FortiSASE to a private application.
What "unified" changes
- SASE combines networking and security; SSE is the security subset. Unified SASE adds a shared policy plane, shared identity/device context, and consistent enforcement across remote users, branches, and cloud edges.
- Fortinet's building blocks include FortiSASE as the cloud service, FortiClient on endpoints, FortiGate at branches and data centers, FortiManager for FortiGate policy, FortiAnalyzer for analytics, and FortiGuard services for inspection.
- Policy should follow user, group, device posture, application, and destination, not just source IP address.
- A single vendor reduces policy drift, but integration design still matters: the FortiSASE console, FortiManager domains, and FortiGate configurations must not contradict each other.
Worked example
A remote worker opens Salesforce and an internal HR portal. FortiClient connects to the nearest FortiSASE point of presence (PoP). Salesforce traffic is inspected by secure web gateway and CASB controls at the PoP. The HR request matches a ZTNA policy: identity and device posture are checked, then only that application flow is tunneled to an application connector behind a data-center FortiGate. A branch FortiGate uses an IPsec tunnel to the same PoP for internet-bound traffic when local breakout is not permitted.
Reasoning: the same user/group/device context drives both the SaaS policy and the private-app policy; SaaS is not backhauled to the data center; and ZTNA reaches the app without a full network tunnel. That is the unified outcome the exam wants you to describe.
Traps that cost marks
- Treating unified SASE as a bundle of separate consoles with no shared policy intent.
- Assuming every flow must traverse one central PoP; proximity and local breakout are design choices.
- Forgetting ZTNA application connectors, so private-app access is incorrectly designed as full remote-access VPN.
- Calling SSE "SASE" when the question asks about WAN edge and branch networking.
- Ignoring where a policy is authored versus where it is enforced.