Fortinet: Sizing, Placing and Living With FortiGate in Georgia
Fortinet’s platform centers on the FortiGate next-generation firewall, with FortiSwitch and FortiAP for the access layer, FortiClient on endpoints, FortiManager and FortiAnalyzer for centralized policy and logging, and FortiGuard for threat intelligence updates. KSEDCO deploys Fortinet across Georgia. Two things go wrong far more often than anything else: the unit is sized on the wrong number, and the boundary is drawn in the wrong place.
Size on the Threat Protection Number
Every firewall datasheet leads with a large throughput figure measured with inspection effectively off. That number is not your number. Once you enable the features you bought the firewall for, meaning intrusion prevention, antivirus, application control and especially deep inspection of encrypted traffic, real throughput drops substantially. Fortinet’s custom processors help, but the physics still apply.
Size the unit against the threat protection figure, with headroom for growth and for the encrypted share of your traffic, which keeps climbing. An undersized FortiGate does not fail cleanly. It becomes a slow network that nobody can explain, and the eventual fix is someone quietly turning off inspection, which leaves you paying for a firewall that is no longer doing the work.
Where the Boundary Goes
Plant floors in Macon and Columbus
The most valuable segmentation in a manufacturing facility is between the business network and the control systems running the line. Production equipment often runs software that cannot be patched, sits on operating systems that reached end of support years ago, and cannot be taken down for maintenance on a security team’s timetable. A firewall between those zones, with policy written around the specific traffic the systems actually need, contains a business-side compromise before it reaches the equipment. The rule set has to be built by watching the real traffic first, not guessed at.
Multi-tenant office space in metro Atlanta
In a leased suite along the Cumberland or Perimeter corridors, you control your own edge and nothing beyond it. Building-provided internet, shared risers and landlord-managed systems all sit outside your boundary, which makes the tenant edge the only place your policy is enforceable. Guest wireless, building systems on your cable plant, and any vendor with remote access all need to land in their own segment.
Suppliers in the Augusta cyber and defense cluster
Organizations feeding the defense and cyber work around Fort Gordon routinely inherit security requirements from their customers, and those requirements name specific controls: segmentation, logged and controlled remote access, and retained evidence that the controls are working. Fortinet’s centralized management and logging make that evidence producible. Whether a particular framework applies to you is a question for your compliance advisers, not your integrator, but the technical controls are ours to build.
Connecting Georgia Sites
SD-WAN is part of FortiOS rather than a separate purchase, which is a genuine advantage when your sites run mixed circuits: fiber in Atlanta, cable in a smaller market, cellular backup at a location where the wired options are thin. Policy can steer traffic by application and by measured link quality, so a voice call moves off a degrading circuit before users start complaining. Given how often Georgia storm season takes circuits down, having a second path that fails over on its own is worth the configuration effort.
What Breaks in Practice
- Expired FortiGuard subscriptions. The hardware keeps passing traffic while its threat intelligence quietly goes stale. Track the renewal dates.
- Deep inspection deployed without the certificate work. Inspecting encrypted traffic requires distributing a certificate to managed endpoints and building exclusions for applications that will not tolerate it. Skip that and you generate a wave of broken applications.
- Permissive rules left in from the cutover. The temporary any-to-any rule added at two in the morning becomes permanent unless someone reviews the policy afterward.
- No log retention. When you need to reconstruct an incident, logs that were never sent to FortiAnalyzer or an equivalent do not exist.
To review a Fortinet design or a firewall sizing for a Georgia site, call KSEDCO at (888) 360-0035.