Fortinet Consulting in Ohio

Configuration review

A review reads the running configuration rather than the vendor datasheet: policy order and shadowed rules, overly broad any-any entries, NAT and virtual IP exposure, which security profiles are actually applied to which policies, SSL inspection scope, logging destination and retention, administrative access exposure, and firmware support status.

Each finding is reported with what it permits today, what changing it would affect, and the order in which changes should be made. Firewall changes are the class of work where an unplanned rollback is most expensive, so change sequencing is part of the deliverable.

• Shadowed, unused, and over-permissive policies identified with the traffic they cover.
• Segmentation between users, servers, guest wireless, cameras, and building systems.
• Administrative access, trusted hosts, and out-of-band recovery path.
• Licensing, firmware, and end-of-support dates mapped against the renewal calendar.

Sizing and replacement planning

Firewall sizing goes wrong when the appliance is chosen against raw throughput numbers rather than throughput with inspection enabled. Encrypted traffic inspection in particular changes the requirement substantially.

Replacement planning starts from the features you intend to run, the circuit speeds you actually have, expected growth, and the support model — then selects hardware, rather than the reverse.

Remote access that people will use

VPN designs fail for human reasons as often as technical ones. If reconnecting is slow or authentication is confusing, users find ways around it. Designs account for the client that your managed devices can actually run, multi-factor authentication, split-tunnel decisions, DNS behavior, session timeouts, and a documented path for revoking access the day someone leaves.