I85PREP
⌘ K
Fortinet FCX study materials
Fortinet FCX study resources

Fortinet FCX: Unified SASE and Secure Access

Fortinet FCX · Work through your exam, one topic at a time.

All guide sections

Unified SASE and Secure Access

Unified SASE and Secure Access tests how users reach private applications and the internet without a blanket tunnel: ZTNA on FortiOS, SSL VPN and IPsec dial-up, FortiClient and EMS posture, FortiAuthenticator identity, FortiCASB for SaaS and cloud-delivered FortiSASE. Expect scenario questions about what gets evaluated in which order when a remote laptop opens an internal app.

ZTNA on FortiOS

  • The access proxy is a virtual host on an interface with a certificate and port. The ZTNA server maps an FQDN and optional path to real servers behind the FortiGate.
  • ZTNA policies match on user group, source address, geography and EMS tags; they are evaluated first-match, so a broad rule above a specific one hides the specific rule.
  • EMS tags only exist as address objects after the FortiClient EMS Fabric Connector is configured and authorized, and only for endpoints that have checked in. Tag names are case-sensitive.
  • Agent-based ZTNA uses FortiClient plus EMS posture; agentless ZTNA lets a browser reach the access proxy with authentication but no device posture. Newer FortiOS releases fold ZTNA into firewall policy as "Universal ZTNA" - know which model your version uses.

SSL VPN and IPsec dial-up

  • SSL VPN offers web mode (bookmarks, rewritten content) and tunnel mode (full or split tunnel), controlled by realms and portals.
  • Host checks and "limit users to one session" are enforced at the portal. Fortinet is steering new designs toward IPsec dial-up and ZTNA, so check release notes before specifying SSL VPN.

SASE, CASB and identity

  • FortiSASE is licensed per user and delivers SWG, CASB, DLP and ZTNA from cloud PoPs; thin edges such as FortiExtender or a small FortiGate can onboard a site.
  • FortiCASB gives API-based SaaS visibility where inline inspection is impossible.
  • FortiAuthenticator supplies RADIUS, LDAP, SAML identity and FortiToken MFA.

Worked example

A user opens app.corp.example.com. DNS resolves to the FortiGate access proxy on wan1:443, and the certificate must match that name. The user authenticates through SAML to FortiAuthenticator, FortiClient presents its identity, and the FortiGate looks up the EMS tag "Domain_Joined". The first ZTNA policy matching user group plus that tag proxies the session to 10.10.20.15:443. No client route to 10.10.20.0/24 is needed - the access proxy is the only exposed path, which is the whole point.

Traps that cost marks

DNS pointing at the server instead of the proxy; certificate name mismatch; policy using a tag the endpoint never received; a broad ZTNA rule placed above the specific one; SAML failures caused by clock skew; counting devices instead of users when sizing FortiSASE.