We're discussing a family of UTM (Unified
Threat Management) appliances. FortiGate is a term which includes a wide range of products,
starting with small ones dedicated to small offices, and developing into devices which are able to grant security and networking for large companies. The
family includes physical devices and
virtual machines, which grant network security on different layers using a
single point of control. FortiGate is optimized
to avoid bottlenecks or delays while the various controls are performed. High availability is also part of the available
features with various solutions to avoid single points of failure.
In the following short list, I will list
some interesting points about the FortiGate solution.
1. Administrative
Interface
If you are experienced with network security
management, you are aware this activity requires interaction with many different software and hardware solutions from disparate vendors. In the
aforementioned scenario, it is normal to have frequent updates to apply on the various products
and to watch more than one monitoring
tool to keep track of security events. The FortiGate solution includes all the
controls you could expect using a patchwork of security products in a single
device with a single administrative interface. It is your
switch, router, firewall, VPN hub, antivirus, anti-spam, proxy, and endpoint security solution all-in-one.
If you define a network object or group for
firewalling purposes, it will be available to define antivirus rules or internet browsing policies. There are two administrative interfaces:
- Web-based manager (a graphical interface usable
through a web browser);
- CLI (a command line interface).
A strong point of FortiGate is that the
graphical interface is complete and easy to use, especially if we think there is a list of operations that we are able to perform inside.
If you have used appliances or firewalls from other vendors, often you have to use not-so-friendly
command lines to obtain the exact result you need. With FortiGate,
you will use the CLI seldomly and only for the most “exotic” features.
2. UTM, the
Fortinet way
Unified Threat Management may be complex to manage,
because you work on different protocols, at different layers and with disparate
threats to consider. In FortiGate, you can have three great layers:
- Networking
services (switching and routing, both static and dynamic);
- Network
security services (firewalling, secure VPN connection, intrusion
detection and endpoint security);
- Application
security services (spam and virus controls, web filtering, application
control and data leak prevention).
As long as you pay (and renew as it expires) the
“bundle” license, you have all the aforementioned features available, including
the updates for signatures and definitions coming to your appliance directly
from Fortinet. You do not have to use all the available controls,
but you are able to turn them on and off “On Demand”, so you could start with a
simple configuration and add control layers when you feel more comfortable.
3. Virtual
Domains
One of the available features include the capability
of a FortiGate to support many Virtual
Domains (VDOMs). VDOMs enable
you to grant access to different companies with different administrators on the
same physical unit. Each one will be able to keep their specific
configuration with no impact on the others. What you are doing is creating
“virtual units”, and keeping on a “root domain” which is used to manage the virtual
domains. VDOMs add a lot of flexibility to the solutions that you are able to plan
using FortiGate.
4. High
Availability and Resiliency
There
are four different ways to make a FortiGate unit have high availability. You could use
a traditional “cluster” design with two or more units: FortiGate Cluster Protocol (FGCP), a solution with an external
load balancer: FortiGate Session Life
Support Protocol (FGSP), a Layer 3 resiliency solution like Virtual Router Redundancy Protocol (VRRP), or a Layer 2 solution like Fortinet
Redundant UTM Protocol (FRUP). Again, we have a great deal of
flexibility to design the best solution for our company’s needs.
5. The Dark
Side of the Moon
It would not be fair to review a product omitting the
negative points. With FortiGate, the main complaint that I have heard is
about the technical support. My personal experience is the same as many people who are not happy with this aspect of the service offered by Fortinet. Often, your problem is diverted to local partners. I have to say that I have had mixed results
with them. While some partners are professional, many are not skilled enough
and I have had costs that are not equivalent to their quality. This is the same issue with other vendors, but that is not an excuse. As long as
Fortinet support sends me to a local reseller or partner, from my point of
view, they are taking responsibility for their capabilities.
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
I had my data speed compromise confirmed by my paid support subscription.