Fortinet

FortiOS6.x · 7.4 · 7.6 CertNSE 4 base RegionLATAM · Remote

I’ve been deploying FortiGates in production since 2018, across FortiOS 6.x, 7.4, and 7.6, on hardware from the 30E up to 200F clusters. This is the case I make to clients evaluating their next firewall, and the parts no one in marketing prints.

Why Fortinet works

Four reasons hold up across deployments.

Where it fits best

Not every shop. The fit is sharpest when one of these describes you:

The honest tradeoffs

Marketing won’t print these. I have, in production. Tap to expand.

None of these are dealbreakers. They're the kind of thing you want to know before you put your name on the project.

Is it right for your company?

Four dimensions to check before you commit:

• Size: 50–2,000 employees. Below 50, even the 60F feels like overkill; look at FortiGate Cloud-managed instead. Above 2,000, the conversation gets nuanced (multi-site SD-WAN, dedicated SOC tooling, FortiManager HA). Bring it to me and we’ll talk specifics.
• IT maturity: One to three dedicated network or security people. Someone who knows what an ACL is, has touched a firewall before, and understands routing, but you’re not running a 24x7 SOC with dedicated threat hunters.
• Existing stack: Not married to Cisco DNA Center or Palo Cortex. If either is deeply embedded with automation pipelines and trained operators, switching has to clear a higher bar than “it’s cheaper.”
• Geography: LATAM works particularly well: regional FortiCare TAC, partner network with hands locally for RMA, and USD pricing with negotiable channel margin. North America and EU are also strong; APAC depends heavily on which country.

If three of the four match, Fortinet is on the shortlist. If all four match, it’s probably the right answer.

Who implements it

Internally, the lead implementer should be a senior network engineer with at least two years of FortiOS exposure. NSE 4 is the practical baseline; NSE 5 once they’re running the Security Fabric across switches and APs. They don’t have to be the only person who touches the box, but they have to be the one who designs the VDOM layout and the firewall policy structure on day one. Those decisions are expensive to undo six months in, when production traffic is flowing through whatever shape the policy table grew into.

External help is worth it for first deployments and for handover training. Fortinet partners do this professionally; independent consultants (myself included) do too. The reason isn’t that Fortinet is hard. The GUI is approachable and the documentation is genuinely good. It’s that operational habits get baked into the configuration in week one, and they’re expensive to refactor in week 52. Pay once for someone who’s done this twenty times, save a year of friction.

If you’re standing up your first FortiGate cluster, let’s talk — start with a 30-minute scoping call; if it’s a fit, we’ll spec a one-week engagement from there.

First steps

1. Read the FortiGate field guide. The practitioner path through the production posts on this site: recovering a locked-out box, building VDOMs and IPsec tunnels, planning the SSL VPN exit. Saves you the chronological scroll.
2. Pick a hardware tier before you spec anything else. My current cutoffs (real-world throughput, not "lab IPS off" marketing numbers):
   • 60F — up to ~25 users, ≤1 Gbps WAN, single site.
   • 80F — up to ~50 users, ≤2 Gbps WAN, branch office.
   • 100F — up to ~100 users, ≤3 Gbps WAN, HQ / aggregation.
   • 200F+ — 150+ users, multi-WAN with SD-WAN, datacenter aggregation.
3. Plan VDOM strategy before you unbox. The VDOM post covers the design tradeoffs: how many VDOMs, what to separate, how the management VDOM stays distinct. Doing this on paper saves you a factory reset.

Beyond first steps: I take on FortiGate deployment, migration, and audit work for SMB and mid-market clients in LATAM and remote globally. Talk to me about your deployment — I’ll tell you in 30 minutes whether it’s a Fortinet job, a Palo job, or a “fix what you have” job.