2.6 FortiGate VM, FortiGate CNF & FortiSASE

Why Cloud Topics Joined NSE 4

The FortiOS 7.6 Deployment and System Configuration domain explicitly added objectives to describe FortiGate CNF and FortiGate-VM in public cloud and to explain FortiSASE administration and user onboarding methods. These are awareness-level, conceptual objectives — you need to know what each product is, how it is licensed or onboarded, and when to use it, rather than deep configuration. They reflect Fortinet's shift from on-box-only security to cloud-delivered and cloud-managed options.

FortiGate-VM in Public Cloud

FortiGate-VM is the virtual-machine edition of FortiGate. It runs the exact same FortiOS image as a hardware appliance, so every concept in this guide — policies, NAT, VPN, security profiles, HA — applies identically. FortiGate-VM runs on:

• On-premises hypervisors — VMware ESXi, Microsoft Hyper-V, KVM, Xen, Nutanix.
• Public clouds — AWS, Microsoft Azure, Google Cloud, Oracle Cloud, and others, deployed from each provider's marketplace.

FortiGate-VM Licensing

Licensing is tied to the number of virtual CPUs (vCPUs) allocated, not throughput. Two models exist:

• BYOL (Bring Your Own License) — you purchase a perpetual or subscription license from Fortinet and apply it to a VM you deploy. Best for predictable, long-running workloads.
• On-demand / PAYG (Pay As You Go) — you launch the VM from the cloud marketplace and pay hourly through the cloud bill, with the license bundled. Best for short-lived or bursty workloads.

A key exam point: more vCPUs require a larger license tier, and adding vCPUs beyond the license does not increase capacity until the license is upgraded.

FortiGate CNF (Cloud-Native Firewall)

FortiGate CNF is a Fortinet-managed, cloud-native firewall service available in AWS and Azure. The crucial distinction from FortiGate-VM is the management model:

• With FortiGate-VM, you deploy, scale, patch, and operate the firewall instances yourself (IaaS — infrastructure you run).
• With FortiGate CNF, Fortinet operates the firewall instances as a managed service. You consume it as SaaS-like security: you define policies and security profiles, and Fortinet handles the underlying firewall scaling, availability, and patching.

CNF integrates natively with cloud routing (for example AWS Gateway Load Balancer) so traffic is steered to the managed firewall without you building and maintaining a VM cluster. For the exam: FortiGate-VM = you manage the firewall; FortiGate CNF = Fortinet manages the firewall, you manage policy.

Public-Cloud Deployment Options Compared

FortiSASE

FortiSASE is Fortinet's cloud-delivered Secure Access Service Edge (SASE) offering. SASE converges networking and security into one cloud service so that remote users and branch sites get consistent protection regardless of location. FortiSASE bundles several functions delivered from Fortinet's cloud points of presence:

• Secure Web Gateway (SWG) — web filtering, AntiVirus, and SSL inspection for user web traffic, applied in the cloud.
• Zero Trust Network Access (ZTNA) — per-application access with continuous identity and device-posture checks.
• Cloud Access Security Broker (CASB) — visibility and control over SaaS application usage.
• Firewall-as-a-Service (FWaaS) — cloud-based firewalling for outbound and inter-site traffic.

The value proposition is that a roaming user's traffic is inspected by a nearby FortiSASE PoP using the same FortiGuard security as an on-prem FortiGate, without backhauling everything to headquarters.

FortiSASE User Onboarding Methods

The blueprint specifically calls out user onboarding methods. FortiSASE connects users and sites in three principal ways:

Exam tip: Agent-based onboarding (FortiClient) gives the deepest protection and ZTNA; agentless SWG covers web traffic on devices you cannot install software on; site/IPsec onboards an entire location at once.

ZTNA in the Cloud-Access Model

Zero Trust Network Access (ZTNA) replaces the implicit "connected to the VPN means trusted on the whole network" model. With ZTNA, every access request to an application is evaluated against user identity and device posture (patch level, antivirus status, certificate) each session, and the user is granted access only to that specific application — never broad network reachability. FortiGate and FortiClient implement ZTNA on-prem, and FortiSASE delivers it from the cloud.

Fortinet positions ZTNA (alongside IPsec) as the strategic successor to SSL VPN tunnel mode for remote access, which is why it appears across the VPN and Deployment objectives.