Deployment overview
FortiSASE secure internet access (SIA) extends an organization’s security perimeter that a next generation firewall typically achieves to remote users by enforcing common security policy for Intrusion Prevention Systems and Application Control, web and DNS filtering, antimalware, sandboxing, and antibotnet/command and control.
SIA for agentless remote users involves setting up a web browser, or a browser-based device using a proxy autoconfiguration (PAC) file to use the FortiSASE secure web gateway (SWG) service as an explicit web proxy. The web browser redirects HTTP and HTTPS traffic to the SWG, which secures user web traffic by implementing SWG security policies. All other non-web traffic bypasses FortiSASE and is forwarded to the internet directly.
You can achieve agentless remote user authentication by configuring the authentication source as Active Directory/LDAP or RADIUS or as a SAML identity provider.
You can automate initial configuration of the proxy settings for web browsers using Windows group policy objects or Microsoft System Center Configuration Manager.
A typical topology for deploying this example design is as follows:
This deployment guide describes how to configure FortiSASE SIA for agentless remote users to redirect, or forward traffic to the FortiSASE SWG or explicit proxy.
Intended audience
Midlevel network and security architects, engineers, and administrators in companies of all sizes and verticals looking to deploy FortiSASE SIA for agentless remote users using FortiSASE SWG should find this guide helpful. A working knowledge of FortiOS, FortiGate, and web browser proxy configuration is helpful.
For comments and feedback about this document, visit FortiSASE Secure Web Gateway Deployment on community.fortinet.com.
About this guide
This deployment guide describes the steps involved in deploying a specific architecture for the FortiSASE SIA use case for agentless remote users using SWG.
Readers should first evaluate their environment to determine whether the architecture outlined in this guide suits them. Reviewing the reference architecture guide(s), such as the FortiSASE Architecture Guide, is advisable if readers are in the process of selecting the right architecture. See also the FortiSASE Concept Guide.
This deployment guide presents one of possibly many ways to deploy the solution. It may also omit specific steps where readers must make design decisions to further configure their devices. It is recommended that readers also review supplementary material found in product administration guides, example guides, cookbooks, release notes, and other documents where appropriate on the Fortinet Document Library.