Which policy type is used to control traffic between the FortiClient endpoint to FortiSASE for secure internet access?

The policy type used to control traffic from a FortiClient endpoint to FortiSASE for secure internet access (SIA) is the Secure Web Gateway (SWG) policy. FortiSASE uses SWG policies to inspect internet-bound traffic from remote users. These policies apply security profiles such as Web Filter, Antivirus, Application Control, and Intrusion Prevention System (IPS) to enforce corporate security standards and protect users from web-based threats. The VPN tunnel is the transport mechanism that directs traffic to the FortiSASE point of presence (PoP), but the SWG policy is what actively controls and secures the traffic according to defined rules.

A. VPN policy: This is incorrect because while a VPN tunnel is used for connectivity, "VPN policy" is too general. The specific policy that inspects and controls the content of the internet traffic is the SWG policy.

B. thin edge policy: This is incorrect as it typically refers to policies for hardware-based thin edge devices (like FortiExtenders or small SD-WAN appliances), not for software-based FortiClient endpoints.

C. private access policy: This is incorrect because private access policies (part of ZTNA) are used to control access to internal, private applications, not for general secure internet access.

1. FortiSASE Administration Guide: In the "Secure Internet Access" section

the guide details the configuration of "Security" policies. It states

"FortiSASE secure internet access (SIA) provides protection for remote users when they access the Internet." The configuration steps involve creating a policy with source (remote users)

destination (all)

and applying security profiles (Web Filter

Application Control

etc.)

which are the core components of an SWG policy. (Refer to the "Configuring security" subsection within the "Secure Internet Access" chapter).

2. FortiSASE Datasheet: The datasheet explicitly lists "Secure Web Gateway (SWG)" as a core capability for the Secure Internet Access (SIA) use case. It describes how FortiSASE "provides comprehensive protection against web-based attacks" and "enforces internet security policies

" which are functions of an SWG policy.