Pass the Fortinet Fortinet Certified Solution Specialist FCSS_SASE_AD-25 Questions and answers with CertsForce

The self-registration portal is the recommended method for granting temporary internet access to contractors or guests. It provides a simple and secure way for the contractor to authenticate and access the internet without requiring full endpoint management or policy configuration.

When central management is enabled, security profile group objects are managed exclusively through FortiManager, making them read-only on the FortiSASE portal to ensure centralized policy control.

Fortinet documentation makes clear that overlay IDs must be identical on hub and spoke for ADVPN to establish correctly:

“When configuring the root and downstream FortiGates the Fabric Overlay Orchestrator configures… IPsec overlay configuration (hub and spoke ADVPN tunnels).”

“The Fabric root will be the hub and any first-level downstream devices from the Fabric root will be spokes.”

In the scenario:

FortiSASE overlay ID = 100

FortiGate hub overlay ID = 101

Mismatch prevents tunnel establishment. Therefore, the fix is: B. The network overlay ID must match on FortiSASE and the hub.

Site-based remote user internet access minimizes individual endpoint configuration by routing user traffic through a centralized FortiSASE connection point (such as a FortiAP or FortiGate), rather than requiring each device to be individually configured with the FortiClient agent.

Once the configured log retention period expires, FortiSASE automatically deletes the older logs to free up storage and maintain compliance with retention policies.