I have a scenario in a client that a couple of ISPs directly connect to the fortiswitches behind the fortigates firewalls instead of connecting to the fortigates or any switches before the fortigate firewalls. As far as I know, the typical network architecture is to separate the internet and corporate network by DMZ or at least a firewall.
However, someone told me that this is okay since the traffic is still under control of the Fortigate firewall which I do not quite understand. What if the fortiswitches route traffic to public directly and not go through the firewalls? Does the fortigate know all of the traffic even if it is not going through them?
Any clarification or explanation would be appreciated.