FortiSASE Branch On-ramp provides a cloud-integrated connectivity method for branch networks that require centralized security enforcement without building a traditional enterprise WAN infrastructure at every location.

Option B is correct because Branch On-ramp enables supported branch routers and FortiGate devices to establish secure IPsec tunnels to FortiSASE security points of presence.

After establishing the connection, branch traffic can be inspected using cloud-delivered firewall and security services. The architecture reduces the need to deploy and maintain a complete set of security inspection capabilities at each remote site.

Branch endpoints generally forward traffic through their local IPsec device, which serves as the default gateway. FortiClient installation is not required solely for branch on-ramp connectivity.

Option A is incorrect because the primary architecture forwards selected branch traffic toward FortiSASE rather than limiting connectivity to direct local internet breakout.

Option C is incorrect because Branch On-ramp does not universally replace endpoint protection software. Endpoint security remains an independent requirement.

Option D is incorrect because application performance optimization is associated primarily with SD-WAN path selection and digital experience monitoring rather than the principal Branch On-ramp function.

The architectural objective is to simplify branch deployment while maintaining consistent security inspection and access policies across geographically distributed sites.