Which two statements about on-ramp tunnels on FortiSASE are correct?

The correct answers are C and D . FortiSASE branch on-ramp is designed for site-based or branch users by creating IPsec connectivity from a branch location to FortiSASE. The study guide states that branches can use on-premises FortiGate or third-party routers, and that supported devices include FortiGate and third-party VPN-capable devices , so option B is false because support is not limited to FortiExtender and FortiAP. The guide further explains that the branch device is configured as the dial-up client and the branch on-ramp location acts as the server; the branch device uses the on-ramp location FQDN as the remote gateway. It also states that FortiSASE supports only IKEv2 for IPsec dial-up tunnels and that IKEv2 supports the network ID feature for establishing multiple tunnels.

Option D is also correct. Fortinet documentation states directly that BGP configuration is shared between Branch On-ramp and Secure Private Access (SPA) and that SPA network configuration must be configured before deploying a Branch On-ramp location. Option A is false because when deep inspection is enabled, FortiSASE requires the FortiSASE CA certificate to be manually installed on endpoints for Branch On-Ramp/site-based users to avoid certificate errors and allow encrypted traffic inspection.