In a FortiSASE environment where always-on VPN is enforced, FortiClient typically establishes a full tunnel to a Security Point of Presence (PoP). By default, a full-tunnel configuration instructs the endpoint to send all traffic-including traffic destined for the local network-through the secure tunnel to FortiSASE for inspection.
* The Local Access Challenge: When a remote user is at home or in a satellite office, they often need to access local resources such as printers, NAS devices, or other computers on the same Layer 2 (L2) broadcast domain. In a standard full-tunnel setup, these local resources become unreachable because the routing table on the endpoint prioritizes the VPN interface for all non-local-gateway traffic.
* Allow Local LAN Access: To resolve this while maintaining the security of the "Always-On" requirement, FortiSASE administrators can enable the Allow Local LAN Access feature within the Endpoint Profile.
* Configuration Logic: This setting modifies the FortiClient configuration (often via an XML update pushed from the FortiSASE EMS) to include an exemption for the endpoint's locally connected subnet.
Specifically, it ensures that traffic destined for the local L2 network does not enter the IPsec or SSL- VPN tunnel, allowing the user to interact with local peripherals while all other internet and corporate- bound traffic remains secured by FortiSASE.
* Incorrect Options: * Option B and C: Sandbox and Anti-Virus protections are security features for threat detection and do not influence the routing of local network traffic.
* Option D: Network Lockdown actually does the opposite; it restricts network access until a VPN connection is established and typically blocks local LAN access unless specific exemptions are made, making it the incorrect choice for enabling access to local resources.

Based on the settings shown in the provided exhibits, the vulnerability remediation workflow is determined by the Endpoint Profile and the Vulnerability Dashboard.
* Endpoint Profile Evaluation: The top exhibit displays the Scan for Vulnerabilities settings. The toggle for Automatically patch vulnerabilities is explicitly set to Disabled. Consequently, the system will not perform automated remediation when a scan completes.
* Manual Patching Requirement: The Vulnerability Dashboard (bottom exhibit) lists several application vulnerabilities with a Patching status of Manual patching required. In a FortiSASE environment, "Manual" indicates that the vulnerability cannot be handled by the client's autonomous update process and requires a direct instruction from the management plane.
* Administrative Intervention: The dashboard includes a Patch endpoints action button. Since auto- patching is disabled in the profile, an administrator must manually select the vulnerabilities and click the "Patch endpoints" button to remotely trigger the patching sequence on the managed endpoints via the FortiSASE cloud service.
* Workflow Logic: While FortiClient acts as the "conductor" on the local machine to facilitate the download and installation, the trigger for this specific scenario is the administrator's remote action within the portal. This differentiates it from Option D (which is disabled) and Option C (which would involve a user manually browsing a website outside the managed SASE workflow).

Integrating FortiSASE with FortiGate ZTNA access proxy enables support for both agent-based and agentless ZTNA access methods, providing flexible connectivity options for different user types. In this architecture, the on-premises FortiGate also performs device posture checks to evaluate endpoint compliance before granting access to internal applications.

ZTNA deployments typically require installing FortiClient on remote endpoints to authenticate users, verify device posture, and enforce secure access policies.

FortiSASE Branch On-Ramp is designed to support branch aggregation use cases with high scalability, allowing up to 2,000 concurrent connections and providing a shared throughput capacity of up to 10 Gbps for branch traffic forwarding into the SASE environment.