Skip to main content
BIRO
BIRO
New Member
August 14, 2025
Question

Connect FortiSASE to branch Fortigates

  • August 14, 2025
  • 1 reply
  • 573 views

Hello All,

I’m working on a case and would like your input on the best approach to resolve it.

The current setup is as follows:

  • FortiSASE is configured as a spoke to a FortiGate “Hub” via SPA hub-and-spoke.

  • Two branch FortiGates are connected to the Hub through IPsec VPN tunnels.

My goal is to allow FortiClient users connected to the FortiSASE to access resources located behind both branch FortiGates.

Do you have any recommendations or best practices on how to implement this?

 

FortiSASE Network Diagram.png

1 reply

ozkanaltas
ozkanaltas
Valued Contributor III
August 14, 2025

Hello @BIRO ,

 

I don't have experience related to topology. But if I think logically, you can use existing ipsec tunnels for service access. Normally direct tunnel from the branch to SASE would work better than this scenario, but if I know correctly, you should buy a SPA license for these branch FortiGates. Because of that, your scenario looks like the best implementation scenario now.

BIRO
BIROAuthor
New Member
August 17, 2025

Thanks for your reply.

I am aware of purchase of new SPA license for the branch, but I am looking for a work around to access private network behind the branches firewalls.

Terms & ConditionsAccessibility statement