FortiGate NGFW
Multi-Site Firewall Refresh

Engagement Overview

Executive Summary

A mid-size manufacturing company operating across four physical sites was running end-of-life SonicWall appliances as its sole perimeter security. Each site had an independently managed firewall with no centralized policy management, no consistency between rule sets, and no next-generation inspection capabilities — basic stateful packet filtering only. The organization had no visibility across sites and no mechanism for detecting or responding to threats at the network boundary.

The network at every site was completely flat. All devices — corporate workstations, production-floor machines, operational technology (OT) systems, servers, and guest WiFi clients — shared the same broadcast domain with no segmentation. A compromise on any single endpoint had unrestricted lateral reach to every other device on the network without traversing a security control. Combined with any/any outbound policies found at three of the four sites, the environment presented a critical attack surface for lateral movement, data exfiltration, and ransomware propagation into OT systems.

The refresh deployed FortiGate NGFW at all four sites, implemented consistent VLAN segmentation, established a full site-to-site IPsec VPN mesh, enabled complete NGFW security profiles (IPS, Application Control, Web Filtering, SSL Inspection, AV), and centralized all management and log aggregation via FortiManager and FortiAnalyzer — executed with zero unplanned production downtime across all four locations.

Phase 1 — Current State Assessment

Site Audit

Technical Debt Identified

Phase 2 — Design & Planning

FortiGate Model Selection

Network Segmentation Design

Migration Strategy

A parallel-run cutover strategy was adopted to eliminate production risk:

1. Install FortiGate alongside existing SonicWall (parallel run)
2. Configure FortiGate with translated rules + new segmentation
3. Staged cutover — migrate VLANs one at a time during maintenance window
4. Validate all production traffic flows post-cutover
5. Monitor for 72 hours before decommissioning SonicWall
6. Decommission and physically remove SonicWall hardware

Phase 3 — FortiGate Deployment

VLAN Configuration

config system interface
    edit "VLAN10-Corporate"
        set vdom "root"
        set type vlan
        set vlanid 10
        set interface "lan"
        set ip 10.1.10.1 255.255.255.0
        set allowaccess ping https
    next
end

Security Profile Configuration

Site-to-Site VPN Mesh

• Dead peer detection (DPD) enabled for automatic tunnel recovery
• Redundant WAN paths at Site A leveraged via SD-WAN for VPN failover
• Phase 2 selectors configured to route only required inter-site traffic

Phase 4 — Policy Migration & Hardening

Rule Translation & Cleanup

Outbound Policy Hardening

# Example: Corporate VLAN outbound policy
Source:       VLAN10-Corporate (10.1.10.0/24)
Destination:  All (Internet)
Service:      HTTP, HTTPS, DNS, NTP
Action:       ACCEPT
Security:     IPS + App Control + Web Filter + AV + SSL Inspection
Logging:      All Sessions

# All other outbound traffic — denied by default (implicit deny)

Phase 5 — Validation

Failover Testing (Site A)

Outcomes

Findings (Pre-Refresh)

MITRE ATT&CK Coverage

Tools Used

This write-up reflects a real-world engagement performed at my current employer. The organization, site names, and specific IP addressing have been anonymized to protect client confidentiality. Network architecture, security findings, and measurable outcomes are based on actual deployment results.