FortiSASE geofencing provides geographical access control by permitting or denying connections to FortiSASE security points of presence (POPs) according to the originating country or region of the connecting user or edge device.
Option D is correct because FortiSASE identifies the source country using the connection ' s public IP address and evaluates it against configured regional access restrictions.
Administrators configure this functionality under Network > Geofencing > Regional access to FortiSASE.
FortiSASE supports three geographical access modes:
Allow all: Permits connections from all countries and regions. This is the default configuration.
Allow specified: Permits connections only from explicitly authorized countries or regions.
Deny specified: Blocks connections originating from selected countries or regions while permitting other locations.
Option A is incorrect because geofencing does not primarily enforce time-based application access restrictions.
Option B is incorrect because content inspection and web filtering are separate security functions.
Option C is incorrect because endpoint data encryption is unrelated to geographical connection restrictions.
Additionally, FortiSASE supports regional compliance rules that prioritize permitted POPs or on-premises gateways for users originating from specified regions. These routing preferences are distinct from geofencing ' s connection admission controls.
