I have some opposing opinions against this guy's post. Like saying "all layers on FortiGate". FortiSandbox is NOT a FortiGate. Separate Forti-somthing product. And so on and on.
But instead of fighting against a post by somebody who works for a company (probably using and/or selling Fortinet products), I would like to point you to below Fortinet's official explanation about this subject.
https://www.fortinet.com/resources/cyberglossary/osi-model
The OSI Model is just a networking model, which almost nobody implemented completely other than original demonstration by big computer companies in '70s. Still referenced and useful but the TCP/IP Model has become a de-fact standard and adopted by virtually everybody after '80s. But again, it's a networking model to connect main frame computers from different vendors a half century ago. The contemporary firewall concept like anti-virus, Intrusion protection, sandboxing, etc. wouldn't fit well to the model but go to application above the 7-layer network model. Or not so important if they fit any layers (who cares?).
Probably different people have different opinions about this rightfully.
Toshi