Technical Tip: How to exempt endpoint from FortiSASE auto-connect when endpoint is on-net using Public IP

[RBA]

Description	This article describes how to exempt an endpoint from FortiSASE auto-connect based on an On-Fabric detection rule based on the Public IP.
Scope	FortiSASE.
Solution	Endpoints that are behind these public IPs should have a standard level of on-premise security and therefore may not need to automatically connect to FortiSASE for security inspection. Go to Configuration -> Endpoints -> Profiles, select On-net rule sets, and select Create and configure the On-net rule. Add the Public IP of the user. The IP added in the screenshot is just for illustration. Navigate to the endpoint profile and enable 'Exempt endpoint from FortiSASE auto-connect when endpoint is on-net'. Select the On-net rule set that is configured with the Public IP.