To exclude specific internet traffic (such as Google Maps) from being tunneled through FortiSASE and instead direct it out the local endpoint interface, you must configure it as a steering bypass destination in the FortiClient endpoint profile. This ensures traffic matching the URL bypasses the FortiSASE tunnel.

FortiSASE addresses modern market trends by offering visibility and control across multicloud and SaaS environments, securing hybrid workforce access, and enforcing zero-trust principles to ensure least-privilege access and consistent security policies.

FortiSASE Secure Private Access (SPA) is designed to provide remote users with seamless and secure access to private applications hosted behind an organization ' s FortiGate Next-Generation Firewall (NGFW) or SD- WAN hubs. 2
* Hub-and-Spoke Architecture: In this deployment model, the organization's FortiGate (either a standalone NGFW or an SD-WAN hub) acts as the hub , while the global FortiSASE Security Points of Presence (PoPs) act as spokes . 3
* IPsec and BGP Integration: The connectivity between the FortiSASE PoPs and the corporate hub is established via IPsec VPN tunnels . To manage routing and ensure that remote users can reach the correct internal subnets, Border Gateway Protocol (BGP) is used for dynamic route exchange. 4 This allows the hub to advertise internal prefixes to FortiSASE, enabling the PoPs to route user traffic effectively without requiring complex static route management.
* Simplified Configuration: To reduce administrative overhead and prevent manual configuration errors on the FortiOS side, Fortinet introduced the SPA easy configuration key (also known as an invitation code or simplified SPA setup). An administrator generates this key in the FortiSASE portal and enters it on the FortiGate hub. This triggers the Fabric Overlay Orchestrator to automatically provision the necessary IPsec tunnels, BGP peerings, and firewall policies required for SPA connectivity.
According to the FortiSASE 25 Architecture Guide , this method is preferred over legacy VPNs because it supports both TCP and UDP traffic, integrates natively with existing SD-WAN deployments, and automatically finds the shortest path to applications using ADVPN (Auto-Discovery VPN) shortcuts where applicable.

Digital Experience Monitoring provides per-user and per-device visibility into connectivity and performance metrics, making it suitable for isolating issues affecting a single user rather than system-wide problems.

If the daily summary report generated by FortiSASE contains very little data, one possible explanation is that the "Log allowed traffic" setting is configured to log only "Security Events" for all policies. This configuration limits the amount of data logged, as it only includes security events and excludes normal allowed traffic.
* Log Allowed Traffic Setting:
* The "Log allowed traffic" setting determines which types of traffic are logged.
* When set to "Security Events," only traffic that triggers a security event (such as a threat detection or policy violation) is logged.
* Impact on Report Data:
* If the log setting excludes regular allowed traffic, the amount of data captured and reported is significantly reduced.
* This results in reports with minimal data, as only security-related events are included.
References:
FortiOS 7.6 Administration Guide: Provides details on configuring logging settings for traffic policies.
FortiSASE 23.2 Documentation: Explains the impact of logging configurations on report generation and data visibility.