What you are evaluating
The scored scope selects Secure Internet Access and Secure Private Access for managed remote users, with the required FortiClient and SPA connectivity. Branch SD-WAN, optional SaaS API features and browser isolation receive no credit in this baseline.
A useful evaluation context
Consider where Fortinet endpoint or network operations already exist, while checking that the selected cloud service and private-access architecture meet the new boundary.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Architecture guidance distinguishes internet, private and SaaS access paths.
- Ordered policies match traffic and apply the configured security features.
- Traffic, security and event logs have explicit retention and external-forwarding considerations.
Where it fits in the work
- Choose the remote-user steering method and private-access connection design.
- Place a narrowly scoped allow rule ahead of the intended deny boundary.
- Reconnect the lab client where required after policy changes and verify both traffic outcome and log retention.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
A policy change removes a test user’s access to an internal lab service.
Evidence to look for
Measure the effect before and after reconnecting the client, and retain the matching policy identifier and event record.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- When do policy changes affect already connected agents?
- Which SPA connectivity option and versions are required?
- Will log rotation remove evidence before the desired investigation window?