Fortinet NSE7_SSE_AD-25 Online Access

To resolve internal hostnames using internal DNS servers for remotely connected endpoints, the following two components must be configured on FortiSASE:

Split DNS Rules:

Split DNS allows the configuration of specific DNS queries to be directed to internal DNS servers instead of public DNS servers.

This ensures that internal hostnames are resolved using the organization ' s internal DNS infrastructure, maintaining privacy and accuracy for internal network resources.

Split Tunneling Destinations:

Split tunneling allows specific traffic (such as DNS queries for internal domains) to be routed through the VPN tunnel while other traffic is sent directly to the internet.

By configuring split tunneling destinations, you can ensure that DNS queries for internal hostnames are directed through the VPN to the internal DNS servers.

Based on the provided exhibits and the logic of FortiSASE On/off-net detection , the endpoint ' s behavior is determined by its network environment relative to the configured rules.

Subnet Matching and Detection: The On-net rule set (named " On-Premises " ) is configured to identify a trusted location when the endpoint " Connects from a known local subnet " . The administrator has defined the known subnet as $192.168.13.0/24$ . Since the endpoint ' s IP address is $192.168.13.101$ , it falls within this range. Consequently, FortiClient detects the endpoint as being on-net (on-fabric).

Action Logic (Exemption): In a FortiSASE Endpoint Profile , when On/off-net detection is enabled and an endpoint matches an " On-net " rule, the standard behavior is to exempt the endpoint from auto-connecting to the FortiSASE VPN tunnel. This design assumes the endpoint is already in a secured office environment where the corporate firewall (FortiGate) provides the necessary protection, making the SASE tunnel redundant.

Comparison of Other Options: * Option B: Incorrect, because the IP matches the defined " known local subnet " rule for on-net detection.

Option D: Incorrect, as auto-connect only triggers when the endpoint is detected as off-net to ensure remote security.