Fortinet · FortiSASE
FortiSASE implementation
Replace VPN with zero trust access and extend FortiGate policy to every remote user.
The short answer
FortiSASE is Fortinet's cloud-delivered security for remote and hybrid users: zero trust access to private apps (replacing VPN), secure web gateway, CASB, cloud firewall and DLP, all managed with the same policies as your FortiGates. WCC implements FortiSASE for organizations that already run Fortinet, so you extend what you own instead of buying a second security platform.
What it includes
What FortiSASE covers
| Component | What it does |
|---|---|
| Universal ZTNA | Gives users access to specific apps, not the whole network, from anywhere. Usually the first thing deployed. |
| Secure web gateway | Filters web traffic and blocks threats for users off the office network |
| CASB | Shows which cloud apps people use and controls risky ones |
| Firewall as a service | FortiGate-style firewall policy for remote users |
| DLP | Stops sensitive data from leaving through web and cloud apps |
| SD-WAN integration | Branch FortiGates connect to the same cloud security |
Is it the right choice
When FortiSASE fits, and when it doesn't
| FortiSASE fits when | Look elsewhere when |
|---|---|
| You already run FortiGate, FortiClient or FortiManager | You have no Fortinet footprint and want a pure-play platform |
| Your team already knows FortiOS | Your network is standardized on Cisco or Meraki |
| Branches and remote users need one policy | You only need simple DNS and web filtering for a small office |
We also implement Zscaler and will tell you which fits.
How it works
How a FortiSASE project runs
Design
Review your Fortinet stack, identity provider and apps, then set the policy plan.
Weeks 1–3
Pilot
FortiClient and access policies for a test group, tuned on real traffic.
Weeks 4–8
Migrate
Users move in waves while the old VPN runs in parallel, then it's retired.
Weeks 8–20
Identity
Works with your identity provider
FortiSASE connects to Microsoft Entra ID, Okta, Google Workspace and other SAML providers, so access follows the user's group and device posture. After go-live, WCC can manage it under managed Fortinet alongside your FortiGates, switches and access points.
Cost
What implementation costs
| Scope | Typical implementation |
|---|---|
| ZTNA only (VPN replacement) | From about $20,000 |
| Full FortiSASE rollout | $60,000–$120,000+ |
Fortinet licensing is separate and priced per user. We quote it after the assessment.
FAQ
FortiSASE questions
What is FortiSASE?
Fortinet's cloud-delivered security for remote users: zero trust access, web filtering, CASB, cloud firewall and DLP, managed with your FortiGate policies.
Do I keep my FortiGates?
Yes. FortiGates keep protecting your offices and branches. FortiSASE extends the same policies to remote users.
How long does it take?
A ZTNA-only VPN replacement typically takes 6 to 12 weeks. A full rollout runs 12 to 20 weeks.
Will users lose access during migration?
No. The old VPN runs in parallel while users move in waves.
How does it compare to Zscaler?
FortiSASE fits best if you already run Fortinet. Zscaler fits organizations without a Fortinet footprint. We implement both.
What does it cost?
Implementation starts around $20,000 for VPN replacement. Licensing is per user and quoted after assessment.
Related
Related guides and services
Get a recommendation
Request a FortiSASE assessment
Tell us your Fortinet setup and user count, and we'll scope the rollout.