Which two deployment methods are used to connect a FortiExtender as a FortiSASE LAN extension? (Choose two.)

FortiExtender can be connected as a FortiSASE LAN extension using two primary methods. The first is an automated, zero-touch provisioning (ZTP) process. In this method, the FortiExtender is registered in FortiCare and, upon its first internet connection, it contacts the FortiZTP service, which directs it to the appropriate FortiSASE instance for configuration. The second method is manual deployment, where an administrator directly accesses the FortiExtender's interface (GUI or CLI) and statically configures the FortiSASE domain name as its management discovery server. Both methods establish the initial control plane connection for provisioning.

B. Enable Control and Provisioning Wireless Access Points (CAPWAP) access on the FortiSASE portal.

CAPWAP is a protocol used for managing wireless access points (FortiAPs), not for deploying a FortiExtender device as a LAN extension.

D. Configure an IPsec tunnel on FortiSASE to connect to FortiExtender.

The IPsec tunnel is the secure data plane that is automatically established after the FortiExtender is successfully deployed and provisioned by FortiSASE, not the initial deployment method itself.

1. Fortinet Docs | FortiSASE 23.3 Administration Guide

LAN Extension > Deployment workflow.

This section explicitly outlines the two deployment methods: "You can deploy a FortiExtender as a FortiSASE LAN extension using one of the following methods: Zero-touch provisioning (ZTP) deployment... Manual deployment..." This directly supports options A and C.

2. Fortinet Docs | FortiSASE 23.3 Administration Guide

LAN Extension > Manual deployment.

This section details the manual process: "In the FortiExtender GUI

go to Settings > Management. For Discovery Type

select Static. For Static Server Address

enter the FortiSASE domain name..." This provides the specific steps for option C.

3. Fortinet Docs | FortiSASE 23.3 Administration Guide

LAN Extension > Deployment workflow > Step 4.

This step clarifies the role of the IPsec tunnel: "FortiSASE pushes the configuration to the FortiExtender

which includes creating an IPsec VPN tunnel between the FortiExtender and FortiSASE." This confirms that the tunnel is a result of deployment

making option D incorrect.