If the daily summary report generated by FortiSASE contains very little data, one possible explanation is that the "Log allowed traffic" setting is configured to log only "Security Events" for all policies. This configuration limits the amount of data logged, as it only includes security events and excludes normal allowed traffic.
* Log Allowed Traffic Setting:
* The "Log allowed traffic" setting determines which types of traffic are logged.
* When set to "Security Events," only traffic that triggers a security event (such as a threat detection or policy violation) is logged.
* Impact on Report Data:
* If the log setting excludes regular allowed traffic, the amount of data captured and reported is significantly reduced.
* This results in reports with minimal data, as only security-related events are included.
References:
* FortiOS 7.2 Administration Guide: Provides details on configuring logging settings for traffic policies.
* FortiSASE 23.2 Documentation: Explains the impact of logging configurations on report generation and data visibility.

The reason for the ping failures is due to the quick mode selectors restricting the subnet. Quick mode selectors define the IP ranges and protocols that are allowed through the VPN tunnel, and if they are not configured correctly, traffic to certain subnets can be blocked.
* Quick Mode Selectors:
* Quick mode selectors specify the source and destination subnets that are allowed to communicate through the VPN tunnel.
* If the selectors do not include the subnet of the webserver (192.168.10.0/24), then the traffic will be restricted, and the ping will fail.
* Diagnostic Output:
* The diagnostic output shows the VPN configuration details, but it is important to check the quick mode selectors to ensure that the necessary subnets are included.
* If the quick mode selectors are too restrictive, they will prevent traffic to and from the specified subnets.
* Configuration Check:
* Verify the quick mode selectors on both the FortiSASE and FortiGate hub to ensure they match and include the subnet of the webserver.
* Adjust the selectors to allow the necessary subnets for successful communication.
References:
* FortiOS 7.2 Administration Guide: Provides detailed information on configuring VPN tunnels and quick mode selectors.
* FortiSASE 23.2 Documentation: Explains how to set up and manage VPN tunnels, including the configuration of quick mode selectors.

The exhibit indicates that the URLhttps://www.bbc.com/is being blocked due to containing a banned word ("fight"). To allow access to this specific URL, you need to adjust the URL filter settings on FortiSASE.
* URL Filtering:
* URL filtering allows administrators to define policies that block or allow access to specific URLs or URL patterns.
* In this case, the URL filter is set to block any URL containing the word "fight."
* Modifying URL Filter:
* Navigate to the Web Filter configuration in FortiSASE.
* Locate the URL filter settings.
* Add an exception for the URLhttps://www.bbc.com/to allow access, even if it contains a banned word.
* Alternatively, remove or adjust the banned word list to exclude the word "fight" if it's not critical to the security policy.
References:
* FortiOS 7.2 Administration Guide: Provides details on configuring and managing URL filters.
* FortiSASE 23.2 Documentation: Explains how to set up and modify web filtering policies, including URL filters.

When remote users connected to FortiSASE require access to internal resources on Branch-2, the following process occurs:
* SD-WAN Capability:
* FortiSASE leverages SD-WAN to optimize traffic routing based on performance metrics and priorities.
* In the priority settings, HUB-1 is configured with the highest priority (P1), whereas HUB-2 has a lower priority (P2).
* Traffic Routing Decision:
* FortiSASE evaluates the available hubs (HUB-1 and HUB-2) and selects HUB-1 due to its highest priority setting.
* Once the traffic reaches HUB-1, it is then routed to the appropriate branch based on internal routing policies.
* Branch-2 Access:
* Since HUB-1 has the highest priority, FortiSASE directs the traffic to HUB-1.
* HUB-1 then routes the traffic to Branch-2, providing the remote users access to the internal resources.
References:
* FortiOS 7.2 Administration Guide: Details on SD-WAN configurations and priority settings.
* FortiSASE 23.2 Documentation: Explains how FortiSASE integrates with SD-WAN to route traffic based on defined priorities and performance metrics.

Based on the provided exhibits, the reason why the Win7-Pro endpoint can no longer access the internet through FortiSASE is due to exceeding the total vulnerability detected threshold. This threshold is used to determine if a device is compliant with the security requirements to access the network.
* Endpoint Compliance:
* FortiSASE monitors endpoint compliance by assessing various security parameters, including the number of vulnerabilities detected on the device.
* The compliance status is indicated by the ZTNA tags and the vulnerabilities detected.
* Vulnerability Threshold:
* The exhibit shows that Win7-Pro has 176 vulnerabilities detected, whereas Win10-Pro has 140 vulnerabilities.
* If the endpoint exceeds a predefined vulnerability threshold, it may be restricted from accessing the network to ensure overall network security.
* Impact on Network Access:
* Since Win7-Pro has exceeded the vulnerability threshold, it is marked as non-compliant and subsequently loses internet access through FortiSASE.
* The FortiSASE endpoint profile enforces this compliance check to prevent potentially vulnerable devices from accessing the internet.
References:
* FortiOS 7.2 Administration Guide: Provides information on endpoint compliance and vulnerability management.
* FortiSASE 23.2 Documentation: Explains how vulnerability thresholds are used to determine endpoint compliance and access control.