FortiSASE 23 Administrator: Early FCSS SASE Skills and the Path to NSE 7 FortiSASE 26 Architect

FCSS_SASE_AD-23 is the FortiSASE 23 Administrator exam from the earlier Fortinet FCSS in SASE track. It is a legacy exam version, but it captures the period when FortiSASE administration became a formal advanced certification target. Fortinet’s July 2026 mapping places FortiSASE Administrator achievements at NSE 7 in SASE, while current advanced preparation uses NSE 7 FortiSASE 26 Architect and the new eight-level NSE structure.

The durable subject is secure access service edge: delivering network and security controls from distributed cloud points of presence while connecting users, branches and private applications. The 23 syllabus emphasized deployment, secure internet access, secure private access, authentication, endpoint integration, security profiles and monitoring. Those are still the right foundations even though the product and certification have moved several releases forward.

SASE changes the traffic path before it changes the policy

Traditional remote access often sends traffic back to a central data center for inspection. FortiSASE can bring inspection closer to distributed users through cloud points of presence, but the administrator must understand how traffic reaches that service. Client agents, tunnels, branch connectivity and DNS behavior all influence the path before security rules are evaluated.

Draw separate paths for an internet-bound user, a branch and a user reaching a private application. Mark where identity is established, where inspection occurs and where the traffic exits toward its destination. This exercise prevents SASE from becoming an abstract marketing term and gives candidates a concrete model for troubleshooting latency, reachability and policy mismatches.

Secure internet access applies inspection with user context

Secure internet access combines web filtering, application control, antivirus and other inspection with identity-aware policy. The goal is not simply to move a firewall into the cloud; it is to deliver consistent controls to users who may never traverse a corporate campus. Administrators should understand how identity, endpoint state and policy groups affect which inspection profile is applied.

Test the same destination from two different user groups and confirm why policy behavior changes. Then examine logs to verify the decision was attributed to the intended user or endpoint. This makes policy troubleshooting more precise and highlights why a SASE design depends on reliable identity context as much as on connectivity.

Secure private access introduces application-specific trust decisions

Zero-trust network access provides the key model for private applications: access should be granted to the specific resource based on identity and context rather than by extending broad network reachability. FortiSASE can broker private access through supported connectors or FortiGate-based paths, depending on the architecture.

Candidates should compare the experience of a user reaching a private web application with a traditional full-network VPN. Identify what the user can reach, which policy evaluated the request and how the application is published. The exercise makes the security benefit visible: successful authentication should not automatically expose unrelated internal networks.

Endpoint integration strengthens policy with device information

FortiClient and endpoint-management integration can contribute device posture and user context to FortiSASE decisions. Administrators should know which information is required for a policy and what happens when the endpoint is unmanaged, disconnected from management or fails a compliance check. A policy that depends on posture must also define the user experience when posture cannot be determined.

The broader identity and endpoint architecture helps separate user identity, device identity and device health. These signals answer different questions. A known user on an unknown device is not the same risk as a managed device with an unknown user, and advanced SASE policy should reflect that distinction instead of collapsing everything into one trust category.

Branch integration connects SASE with SD-WAN behavior

Branches may use FortiGate and SD-WAN to steer traffic toward FortiSASE while preserving resilient connectivity. The administrator needs to understand which traffic should go directly to the internet, which should be inspected through SASE and which should use private application paths. Transport health and policy can change that choice dynamically.

Create two branch transports and observe what happens when the preferred path degrades. Confirm the branch still reaches FortiSASE and that sessions are re-established as expected. This connects networking and security: a perfect cloud policy cannot help a site whose underlay or path-steering logic cannot deliver traffic reliably to the service.

Monitoring should explain user experience, not just service status

FortiSASE dashboards and logs can show users, security events and service health, but troubleshooting should begin with the user transaction. Identify the user, device, application, point of presence and policy decision, then check whether latency or denial occurred before or after inspection. A green platform status does not prove every path to every application is healthy.

Maintain a small set of test transactions for internet access and private access. Run them after policy or connector changes and compare the logs with the expected outcome. This creates an operational baseline and helps teams distinguish a global FortiSASE issue from an application-specific route, identity or endpoint problem.

Location and point-of-presence selection should also be considered when user experience varies by region. Two users with identical policy can see different latency if they enter the service through different internet paths or service locations. Compare a failing user with a nearby control user, then inspect the selected path and application destination. This helps separate a policy problem from a regional transport or service-routing issue and preserves useful evidence before any global change is attempted.

Licensing and entitlement should be part of operational checks as well. Cloud-delivered features can depend on subscriptions or enabled services that are easy to overlook when the network path appears healthy. Verify the service state before rebuilding connectors or profiles, and document which capabilities the organization expects to be active. This avoids treating an entitlement problem as a mysterious configuration failure.

FortiSASE 23 is best treated as the first layer of a later architecture

The internal FortiSASE 23 material remains useful for understanding the original administrator scope, but current candidates should not stop there. The immediate next generation was FortiSASE 24 Administrator; later versions expanded centralized management, branch use cases, endpoint controls and architecture depth before the program moved to FortiSASE 26 Architect.

Use the 23 objectives to build the SASE mental model, then validate current details through the active Fortinet NSE structure and Fortinet documentation. The transferable skills are traffic-path reasoning, identity-aware policy, private access, endpoint context, branch integration and evidence-driven monitoring.

Policy design should separate users, devices and application classes

Early FortiSASE administration already required more nuance than a single allow-or-deny rule. Different user groups can need different web categories, private applications or inspection levels, and device state may further refine access. Build policies around real business populations and application needs rather than around broad network locations. That approach makes cloud-delivered enforcement easier to explain and reduces the chance that one emergency exception quietly becomes the default for everyone.

Test overlapping policy conditions deliberately. Use two users with different group membership and one device that lacks an expected posture signal. Confirm which rule wins and why. This exercise helps candidates understand precedence and avoids a common operations problem: assuming the most specific-looking rule matched without checking the evidence FortiSASE actually recorded for the session.

Private access depends on connector health and application reachability

A user can authenticate successfully to FortiSASE and still fail to reach a private application because the connector path, internal DNS, application server or local routing is unhealthy. Administrators should therefore separate the cloud access decision from the private-side delivery path. Test the application from the connector side where possible and verify that the published service definition matches the real host and port.

When several private applications fail together, look for a shared connector, tunnel or internal dependency before changing individual access rules. When only one application fails, compare its definition and backend health with a working service. This pattern-based diagnosis prevents security policy from becoming the default suspect for every private-access complaint.

Operational readiness includes policy rollback and user communication

Cloud-delivered policy can affect many distributed users quickly, so administrators need a recovery plan before changing authentication, inspection or routing behavior. Keep a known-good configuration reference, define who can approve rollback and maintain a small set of tests that prove internet and private access after a change. The scale of SASE makes disciplined change control more important, not less.

User communication also matters because remote users may have no alternate corporate path when SASE access is impaired. A support process should distinguish a global service incident from a local ISP or endpoint problem and communicate the scope accurately. These operational habits are not tied to version 23; they remain essential as the platform evolves into the current architect-level track.

Early SASE deployments also need attention to DNS because user traffic may resolve public and private applications differently depending on location and access method. A private application can be correctly authorized but still unreachable if the endpoint receives a public answer, cannot resolve an internal name, or sends the request outside the expected private-access path. Include name resolution in every application test and record which resolver supplied the address before changing policy.