I85PREP
⌘ K
FCSS SASE Architect study materials
FCSS SASE Architect study resources

FCSS SASE Architect: SASE Architecture: Edges, PoPs, and Traffic Steering

FCSS SASE Architect · Work through your exam, one topic at a time.

All guide sections

SASE Architecture: Edges, PoPs, and Traffic Steering

The SASE domain tests architecture and deployment decisions: which edges you support, how traffic reaches a security PoP, and how identity and underlay quality affect enforcement. Expect scenario questions that compare branch, remote-user, and cloud-edge designs rather than simple definition recall.

Core architecture rules

  • SASE is identity-driven and cloud-delivered. The policy decision uses user/group, device posture, application, location, and destination, then enforcement happens at a FortiSASE PoP or an on-premises FortiGate.
  • Supported edges include remote workers, branches, and cloud workloads. Traffic steering can use FortiClient, IPsec/SSL tunnels from FortiGate, or cloud on-ramp methods.
  • The security stack at the PoP includes SWG, CASB, FWaaS, ZTNA, DLP, IPS, and sandboxing as licensed. Networking includes SD-WAN, local internet breakout, and WAN optimization.
  • PoP selection should minimize latency for inspected traffic. Backhauling SaaS traffic to a distant data center defeats the latency benefit and concentrates risk.
  • Underlay health matters: a SASE design is only as good as the ISP path and tunnel availability to the PoP.

Worked example

A 200-user branch has two ISPs and needs SaaS, private ERP, and voice. The FortiGate runs SD-WAN across both ISPs and forms IPsec tunnels to the nearest FortiSASE PoP for internet-bound traffic. SaaS breaks out at the PoP for SWG/CASB inspection. ERP uses a separate IPsec path to the data center. Remote users run FortiClient to the same PoP. Voice is steered by SD-WAN SLA rules, not by the SASE security policy.

Reasoning: the PoP provides consistent security for SaaS without data-center hairpinning; SD-WAN keeps the branch resilient; private ERP keeps its own path; identity policy is enforced at the PoP and at the data-center edge. The design separates security enforcement from underlay selection.

Traps that cost marks

  • Defining SASE as remote-access VPN only and ignoring branch or cloud edges.
  • Assuming one PoP serves all users regardless of geography.
  • Designing security policy without identity-provider integration or device posture.
  • Confusing SASE with SSE: SSE does not include SD-WAN or branch WAN edge.
  • Ignoring underlay failover, so the PoP is reachable only over one ISP.
  • Forgetting that local breakout still needs inspection policy.