Category: Fortinet

Customer Perspectives

The COVID-19 pandemic forced many businesses to rapidly enable most, if not all, of their employees to work from home. But while the lights are off in corporate conference rooms and cubicles, on-premises data, applications, and servers are still serving critical business functions for organizations. Not only that, but all those remote workers still require secure access to the network resources.  Despite these challenges, Fortinet was able to rapidly expand remote access without compromising security or productivity.

Existing Secure Teleworker Solutions Ensure Optimal Work-From-Home Experience

Fortinet has offices around the globe. In the company’s Europe, Middle East, and Africa (EMEA) division, the usual pool of 600 remote workers suddenly grew to 1,600 as a result of work-from-home mandates. Typically, such a massive shift to remote work would require a months-long planning process and significant investments in new technology—a luxury the Fortinet IT team did not have. Because of this, IT teams that could leverage existing security solutions were best positioned to smoothly transition their workforce to telework without sacrificing performance or protection. Fortunately, the Fortinet IT team was able to do just that, scaling their existing Fortinet security architecture to meet the requirements of this new normal at no additional cost.

“Employees need access to file servers, application servers, and other back-office resources, as well as to our laboratory devices for use in testing and in proofs of concept,” explains IT Manager Cyrille Carrasco. “These resources are not available via the internet, and for many employees, this was their first experience of working remotely.” Furthermore, staff across Europe needed remote access to their Fortinet phones. “This is important for all employees, but particularly for workers in our call center,” Carrasco says. “They answer between 40,000 and 50,000 calls each month.”

The built-in capabilities of FortiGate firewalls, FortiClient, and other security technologies enabled the IT team to scale rapidly and provide all call center employees with remote access to the phone system and other necessary applications without straining resources. With minor configurations, including optimizing the FortiVoice phone systems to give remote employees extended telephony capabilities by using a softclient on their computers, the existing solutions ensured secure telework for employees without requiring additional hardware or CAPEX. As a result of these efforts, they expanded their virtual private network (VPN) capacity to serve three times as many concurrent users as they served previously, in a way that IT staff can secure from their own home offices.

Preparing for Widescale Remote Access to the Corporate Network

Fortinet EMEA was using FortiGate next-generation firewalls (NGFWs) to give remote users VPN access to the corporate network, using secure socket layer (SSL) VPNs. With these existing FortiGates—which include IPS, antivirus protection, and application control features—Fortinet had all the technology in place needed to enable widespread work-from-home. 

They also ensured employees could access VPN through any point of presence with redundant options for SSL VPN connectivity throughout the region. So if one VPN gateway were to become unreachable, the user’s FortiClient would give them options of other available gateways that they could connect instantly to avoid disruption.

Secure Connectivity: Any Time, Any Place

For end-users who already had company-issued laptops, the technology transition has been easy and transparent. The FortiClient solution provides options for SSL VPN connections to FortiGate firewalls, and the central IT team can seamlessly push out any necessary configuration changes from their own home offices.

The SSL VPN connection enables all traffic to be encrypted. Then, the FortiGate firewalls scan all traffic that comes in through the VPN. The FortiAuthenticator user identity management server utilizes the corporate Active Directory (AD) to confirm user credentials and permissions to access specific network resources, while the FortiToken solution verifies user identity. “The clients, the FortiGates, the servers, the switches—all the equipment that needs authentication is controlled by two-factor authentication within FortiAuthenticator,” Carrasco explains.

Further, in order to optimize communication efficiency, the IT group installed a voice softclient for every Fortinet EMEA employee. “Our staff needed all the same capabilities they have in the office, so we set up a softclient that connects employees’ computers to the FortiVoice PBX [private branch exchange],” Carrasco says. “As a result, all our employees are able to stay connected to one another without losing their productivity.”

And because all these solutions integrate into the Fortinet Security Fabric, the IT staff can manage the security architecture through a single pane of glass, even while working from home. With these existing solutions, Fortinet’s security team was well-positioned to facilitate new work-from-home policies without sacrificing the protection or performance of their users, applications, and data.

Discover how Fortinet Teleworker Solutions enable secure remote access at scale to support employees with a wide array of access requirements.

Find out how Fortinet’s Security Fabric delivers broad, integrated, and automated protection across an organization’s entire digital attack surface from IoT to the edge, network core and to multi-clouds. 

Find out how Echoenergia and New Zealand Red Cross used Fortinet’s Security Fabric for protection from the network edge to core. 

Even before COVID-19, SaaS-based productivity tools such as Microsoft 365 had been gaining market-share at a remarkable pace. Today, with hundreds of millions of employees working from home, enterprises are turning to software as a service (SaaS), including Microsoft 365, like never before. In doing so, many companies are decommissioning their old email gateways and relying on the security that comes with the SaaS applications. However, as email is the most common transport mechanism for cyber-attacks, it is important that organizations ensure they have an advanced security posture.

Microsoft offers two security services for M365: Exchange Online Protection (EOP) and Advanced Threat Protection (ATP). These services have most of the features you need to secure your productivity infrastructure but poor detection marks both these security solutions. As a result, organizations are turning to Fortinet’s Dynamic Cloud Security solutions, including FortiMail, to enhance and complement native capabilities within Microsoft 365 and better protect their journey to the cloud. 

Fortinet’s FortiMail Email Security Ranks High in Industry Tests

The best known tests for email security solutions are the Virus Bulletin Spam (VBSpam) Report, ISCA Advance Threat Defense (email) and SE Labs Email Security Gateway test report. 

The latest SE Labs report, which pitted leading email security services against live targeted attacks that are the same or similar to those seen in recent security events, reveals differences between Microsoft 365 security and security from third party vendors. The report consolidated the results in a single metric, “True Accuracy,” that took into account not just detection but also remediation, false positives, and false negatives. In particular, this metric included the solution’s handling of non-malicious messages and components of those messages, such as attachments and links to websites. SE Labs found Microsoft’s email security solutions had accuracy ratings of less than 30 percent, revealing the need for an advanced third party solution capable of augmenting Microsoft 365 security. SE Labs found that Fortinet’s FortiMail was among the leaders in total accuracy ratings with over 90% of threats detected.

Other third party tests reveal Fortinet’s ability to detect threats with few or no false positives: Virus Bulletin, in its quarterly comparative review of SPAM detection, declared Fortinet the most effective solution, detecting 99.84% of bad emails with zero false positives. ICSA’s tests confirmed the Virus Bulletin findings: after 5 weeks of extensive testing, ICSA found that Fortinet FortiMail detected 99.8% of threats with a false positive rate of under 1.6% – both among the best results of any product tested.

Advanced Microsoft 365 Security Through the Fortinet Security Fabric

Through its Security Fabric, Fortinet offers the broadest, most-effective set of cloud-ready solutions to complement M365. Fortinet works closely with Microsoft to integrate its solutions tightly with M365, providing flexible consumption models and deployment options for on-premises, hybrid and multi-cloud environments. Built from the ground up to co-exist and complement M365, Fortinet’s approach allows customers to use the applications they are most familiar with from Microsoft and the proven security they can rely on from Fortinet. 

Detection of malicious email is only part of M365 security – but is probably the most important part. Other elements of an effective M365 security solution, which Fortinet provides include:

• Strong Authentication: FortiToken Cloud provides management of multifactor authentication of two-factor tokens, including both software and mobile tokens, in a FortiGate environment from provisioning to revocation.    
  • Robust platform to manage the lifecycle of your two-factor authentication system.
  • Intuitive dashboard is available anywhere there is an internet connection.
• Email Security: FortiMail Cloud inspects incoming and outgoing emails to stop threats and prevent data loss.    
  • Independently top-rated effectiveness: Routinely earning top scores in Virus Bulletin, ICSA Labs, and other third-party testing.
  • Comprehensive coverage: Anti-spam, anti-phishing, anti-malware, sandboxing, content disarm, impersonation analysis, data loss prevention (DLP), encryption, and message archiving.
• Sandboxing: FortiSandbox Cloud analyzes files and URLs for new and previously unknown cyberattacks. FortiSandbox utilizes real-time threat feeds along with heuristic analysis, machine learning, and artificial intelligence to identify zero-day threats.
• SaaS Security: FortiCASB integrates tightly with Microsoft 365 to provide visibility and control into how Microsoft 365 is being secured and used. FortiCASB will:
  • Inspect content in transit or at rest for threats with the top-rated threat intelligence of FortiGuard Labs AV and sandbox services
  • Monitor and ensure appropriate user behavior and entitlements as well as control authorized use of a wide range of sensitive data types, as defined by industry regulations or corporate policy
  • Identify instances of un-approved “shadow IT” apps in the cloud
  • Monitor SaaS apps such as M365 for compliance issues such as encryption of data, proper authentication and appropriate security policies

Fortinet’s Dynamic Cloud Security Solutions 

SaaS-based applications such as Microsoft 365 are one example of the need for enterprise-class security solutions for cloud-based infrastructures. Fortinet’s Dynamic Cloud Security solutions include network security, application security and platform security for all major clouds, both public and private.

The Fortinet Cyber Threat Assessment Program is a free program that analyzes your email traffic for spam, phishing emails and malware. After the two-week assessment, Fortinet provides a detailed risk assessment report. Sign-up for your personal email security assessment and get started today.

For more information about how Fortinet can help you secure your Microsoft 365 deployment, visit the FortiMail and FortiCASB product pages or contact your local Fortinet representative.

_{* Figure 1: SE Labs Email Security Gateway test report.} 

Customer Perspectives

An organization’s continued growth depends on their vision and roadmap to expand business opportunities, and this is especially true in the financial services industry. And with expansion, comes the immediate need to implement solutions that meet the demands of business-critical applications rapidly shifting to the cloud, while preserving a strong security posture at all edges. Organizations have understood the cost effectiveness of moving away from MPLS to cheaper and more effective alternatives such as broadband and LTE for some time now, but this has not exactly solved the problem of achieving the best user experience with visibility and control into their network performance. 

Large distributed enterprises with thousands of branch offices need reliable and secure connectivity from home to branch to data center to cloud. There is an urgent need for digital innovation to address challenges such as a lack of centralized control, poor real-time application performance with traditional routing technologies, and security. They require quick deployment and change management enabled with automation to translate their business intent to effective business policies and deliver exceptional application performance while maintaining business continuity. 

With a single dedicated WAN link at every one of their 3,000 branch locations, one large financial services organization began experiencing poor application performance that had a severe impact on their workforce and customer experience with business-critical financial applications. Security measures for centralized inspection and cloud access were implemented in their data centers, which forced branch traffic to be backhauled. These factors put tremendous strain on bandwidth and performance across their dedicated MPLS circuits, and the clear solution was to move away from MPLS to multiple direct internet access with a secure, reliable, and consolidated WAN Edge. Consolidation also meant complete visibility into all their applications, improved network performance that extends to branch/LAN networks for easy management and troubleshooting while also simplifying the network infrastructure, reduced OPEX + CAPEX costs, and accelerated cloud access.

Financial Service Organization Expands Business Opportunities 

With several SD-WAN vendors vying for selection as part of their proof of concept trials, this organization was quick to discover that Fortinet’s robust Secure SD-WAN solution differentiated itself by providing a fully integrated solution that combined business agility, optimal connectivity, strong security, and best user experience into a single form factor that was easy to deploy and manage. Fortinet Secure SD-WAN is also able to provide WAN Edge consolidation with integrated self-healing SD-WAN and security on the industry’s best-performing appliance and centralized management extending to the branch network. Fortinet was the only solution that proved this organization could replace their legacy routers, poorly performing security solutions, and MPLS circuits with a single vendor to solve their infrastructure needs to ensure business continuity, improve application performance, and simplify branch management.

Key Benefits of Fortinet Secure SD-WAN

A few of the key benefits and immediate business outcomes provided by Fortinet’s Secure SD-WAN solution include:

• Self-healing Capabilities to Achieve Exceptional User Experience: Fortinet Secure SD-WAN solved their need for traffic steering based on application policy and network SLA such as packet loss, jitter, and latency to achieve best user experience for their business applications designed to handle critical customer financial transactions. With a compact desktop form factor offered with the FortiGate 50E series, they were able to replace MPLS circuits with dual high bandwidth broadband circuits that can effectively forward traffic in an active-active fashion and transform their infrastructure to self-heal with SD-WAN remediation capabilities and deliver optimal application performance across all branch offices.
• Reliable Connectivity for Business Continuity: This organization required reliable connectivity for their real-time application traffic, used extensively for companywide collaboration and customer service. Fortinet Secure SD-WAN’s ability to enable branch-to-branch VPN connectivity at scale and detect SLAs ensured the voice/video traffic were forwarded on the best available, highest performing, and lowest latency path to achieve best quality of experience. 
• Cloud On-Ramp for Accelerated Cloud Access: They also required secure cloud access for compute and business applications hosted on AWS across their branch offices. Fortinet’s integrated NGFW and one touch connectivity to AWS virtual WANs enabled accelerated access to critical business applications on direct internet links, while ensuring a strong security posture. 
• Ease of Management with Consolidation and Simplification from the WAN to LAN Edge: Prior to implementation, this organization experienced longer troubleshooting cycles due to limited visibility into their LAN and applications during their network outages. This also meant significant delays for their customer transactions, support and services. Fortinet’s centralized management and control offered with FortiManager enabled their IT staff to handle change management from WAN to LAN in a matter of days. Advanced analytics and telemetry offered both in real-time and historical via FortiAnalyzer allowed quick resolution cycles and IT staff to spend more cycles on digital innovations. 
• Leveraging Fortinet Secure SD-Branch to Ensure Branch Office Security Without Impeding Productivity: By implementing Fortinet Secure SD-Branch at their remote locations, this organization gained complete visibility and control across their entire digital attack surface and was able to extend the benefits of the Fortinet Security Fabric to their distributed branch locations. Further, with branch-to-branch VPN connectivity at scale, this financial service organization enabled secure connectivity without impeding productivity for employees. 

Take a security-driven approach to networking to improve user experience and simplify operations at the WAN edge with Fortinet’s Secure SD-WAN solution.

Read these customer case studies to see how De Heus and Burger King Brazil implemented Fortinet’s Secure SD-WAN to alleviate network complexity, increase bandwidth, and reduce security costs.

Engage in our Fortinet user community (Fuse). Share ideas and feedback, learn more about our products and technology, or connect with peers.

We at Fortinet are very proud of the success that our FortiNAC solution has achieved, including being recognized by Frost & Sullivan as the fastest growing network access control (NAC) solution on the market. We believe our ability to maintain a growth rate over two times higher than the overall NAC market growth rate is a testament to our focus on delivering a solid zero trust architecture and our ability to converge NAC and the Internet of Things (IoT).

Why NAC Matters

With the surge in IoT devices coming onto networks, the ability to see and control everything connecting to the network is more critical than ever. As more and more companies grapple with securing their wired and wireless networks, effective NAC solutions are becoming necessities, not “nice-to-haves.” It’s no surprise that you can’t secure something if you don’t know it exists or can’t quickly identify it. A robust NAC solution is required to see and understand exactly what is on your network.

NAC’s Checkered Past

While NAC has been around for decades, earlier iterations were difficult to deploy and use. A critical flaw in older solutions was the dependence on the 802.1x protocol for authentication. While it worked well for wireless networks, the administrative pain of deploying it on switching networks usually led to project abandonment after months or sometimes even years of trying. 

Issues with Some Current NAC Solutions

Today, some NAC solutions avoid relying on 802.1x by using traffic patterns to identify devices on the network. However, this approach has also led to challenges. Customers who tried these solutions, then turned to us for help, shared that this approach has two main problems. 

• First, the need to see traffic in order to identify a device means that the device needs to be on the network long enough to generate a significant amount of traffic. Therefore, a device would be on the network for 10 to 30 minutes prior to an identification. Sometimes, devices were so quiet that they were never detected! 
• Second, traffic sensors are needed in every location. For organizations with multiple locations, this results in high deployment and maintenance costs.

The Fortinet Advantage

FortiNAC does not rely on 802.1x, so it’s easy to implement on both wired and wireless networks. It also only needs to be deployed in one location. A second high-availability unit can be deployed for disaster recovery (DR), if desired.

To discover every user, application, and device, FortiNAC scans your network. With up to 20 different techniques, it can then profile each element based on observed characteristics and responses, as well as calling on FortiGuard’s IoT Services, a cloud-based database, for identification look-ups.

With these technical and architectural advantages, FortiNAC is proving itself and gaining market share. There is also the advantage of seamless integration into the Fortinet Security Fabric. As part of the Fortinet Security Fabric, FortiNAC can take enforcement action in the network based on information gathered by other security products. FortiNAC is also able to extend the power of the Security Fabric to the multiple third-party switching and wireless vendors that FortiNAC supports. 

To learn more, take a look at the full Frost & Sullivan report.

Discover how Fortinet’s Network Access Control solution (FortiNAC) provides organizations with the ability to see and control all the devices and users connected to the network.

Customer Perspectives

Organizations are increasingly migrating data and applications to and between public cloud environments. It’s difficult for these organizations to gain visibility and control of their security posture when they rely on disparate solutions that all take different approaches to security and offer different tools. It’s also hard for a strained security team to stay on top of isolated solutions that fail to integrate. 

Through its Dynamic Cloud Security offerings, Fortinet provides customers with solutions that provide centralized management and visibility across public cloud, private cloud, hybrid cloud and multi-cloud. Fortinet integrates with all leading cloud service providers to give customers advanced security to protect their public clouds. Among the cloud providers, Fortinet directly integrates with Oracle Cloud Infrastructure (OCI), delivering the broadest set of security use cases available for OCI.

The following customers selected Fortinet’s Dynamic Cloud Security to secure their OCI workloads or applications:

U.S. Public College Turns to Fortinet’s Dynamic Cloud Security Offerings for Seamless Integration

Located in a hot spot for natural disasters, a U.S. public college decided to migrate some of its key applications to the cloud, starting with its PeopleSoft enterprise resource planning (ERP) application suite. The college wanted to ensure that if its on-campus network was downed by a storm, it would still be able to support its tens of thousands of students, faculty and staff. Because the college began its cloud migration with PeopleSoft—an Oracle solution—they looked to Oracle Cloud Infrastructure (OCI) as a possible cloud service provider. When it came to securing its new deployment, this customer turned to Fortinet’s Dynamic Cloud Security offerings that seamlessly integrate with OCI. 

A rapid and highly successful proof-of-concept (POC) led to the selection of the FortiGate-VM next-generation firewall (NGFW) on OCI. The FortiGate-VM firewall also enabled the college’s IT team to segment the network into zones, effectively isolating its websites, applications, databases, and administrative domains. This was especially important, as numerous cyberattacks enter on-premises networks through internet-exposed interfaces in cloud environments. Segmentation prevents attacks from spreading, minimizing the risk to the rest of the college network.

Additionally, the college’s DevOps team has also migrated its testing environment to OCI. The DevOps team is benefitting from OCI’s Shapes – templates that determines the number of CPUs, amount of memory, and other resources allocated to a newly created instance – as well as preconfigured Terraform templates for FortiGate NGFWs– simplifying the customer’s secure journey to OCI. They are saving staff hours every time they spin up a test environment, which they do about 12 times a year leading to significant annual productivity gains. In addition, using templates reduces misconfigurations in the cloud, a potential source of firewall breaches.

Large Supermarket Chain Simplifies Migration to Oracle Cloud Infrastructure

A supermarket chain with more than 40 stores was using firewalls in tandem with older-generation equipment. This posed several problems prompting them to search for a cloud platform to host its servers. After the company’s IT team considered different options, it chose Fortinet’s Dynamic Cloud Security offerings which provided the best solution and included a strong recommendation from Oracle. Specifically, this customer deployed Fortinet’s FortiGate-VM in the Oracle Cloud environment. 

As a result of Fortinet and OCI’s seamless integration, this customer was able to establish protection between servers, and created a secure communication channel from the cloud to the data center, allowing information to be exchanged more securely. The IT team instantly saw how Fortinet provided a single management panel with native visibility and control right inside the cloud. 

Working together with the customer and Oracle, Fortinet was able to help the customer migrate more than 40 database workloads in a secure environment to OCI. Overall, the company has been able to simplify its processes and boost network performance, while having confidence that its cloud environment isn’t vulnerable to threats.  

Identity Management Provider Secures Crucial Cloud Environments

An identity management provider had recently transitioned to an OCI-based architecture to streamline IT operations, reduce costs, and improve organizational agility and scalability. It was then looking for a security solution to protect its workloads. The company selected Fortinet’s Dynamic Cloud Security offerings, including FortiGate-VM next-generation firewalls (NGFWs) in a virtual machine (VM) footprint and high-availability configuration, to secure traffic to and from the company’s OCI instance, as well as for internal network segmentation. One differentiator of Fortinet’s offerings was the broadly supported next-generation firewall and Security Management solutions, which run natively in OCI.

The identity management provider had used FortiGate NGFWs to protect its on-premises network for years and they trusted the ability of Fortinet to secure their crucial cloud environments as well. The customer also recognized how Fortinet’s support of multi-cloud environments was beneficial for standardizing solutions across not only its OCI and on-premises environments, but also across other cloud services. 

Fortinet Delivers Dynamic Cloud Security for Customers Using Oracle Cloud Infrastructure

Fortinet Dynamic Cloud Security solutions provide the necessary visibility and control across cloud infrastructures, enabling secure applications and connectivity from data center to cloud. Ultimately, Fortinet gives customers the confidence to deploy any application on any cloud infrastructure. 

Learn how Fortinet’s dynamic cloud security solutions provide increased visibility and control across cloud infrastructures, enabling secure applications and connectivity from data center to cloud. 

Read these customer case studies to see how Hillsborough Community College and WeLab implement Fortinet’s dynamic cloud security solutions for secure connectivity from data center to the cloud. 

Fortinet was built on the premise that a network firewall should not just deliver a full range of tightly integrated network and security functions – a goal that many other NGFW solutions still fail to achieve ­– but do so with the scale and performance that today’s most demanding hyperscale environments require. And all at a price point that doesn’t break the bank so that the decision makers don’t have to make a tradeoff between best of security at a scale vs. the cost.

That premise starts with two essential strategies. The first is to offer solutions designed to actually operate together as part of a single security system, sharing threat intelligence to achieve a strong security posture. The second one is to offer scale with not just a collection of mostly isolated security systems wrapped together in a cumbersome and expensive cluster for scale. That first objective is what has driven the development and delivery of the Fortinet Security Fabric. The second strategy involves developing active, purpose-built hardware processors designed to accelerate the performance of essential security functions within a single system.

Announcing the FortiGate 4400F Network Firewall

The truth is, very few vendors have made more than a token effort at achieving the first, and none even seem to have a game plan for achieving the second. And even if they were to start, any sort of solution would be years away. ASIC development is a long and expensive process, and other security vendors are already more than a decade behind. 

Fortinet already has two purpose-built SPUs (Security Processing Units) in place that power our security hardware, with a new hybrid processor designed just for SD-WAN. Our content processors (CPs) are designed to accelerate critical security functions, such as inspecting encrypted traffic, and our network processors (NPs) accelerate networking functions. And these aren’t just fledgling solutions. This past February we released our 7th generation network processor (the NP7). The first FortiGate NGFW solutions powered by NP7 were released soon after, as the FG-1800F and FG-4200F.

Today, the launch of the FortiGate 4400F continues our commitment to delivering SPU-powered products capable of providing the fuel needed for digital innovation. It is positioned to support the most processor-intensive security environments of today – environments that will quickly become the norm of tomorrow.

Today’s Networks Require Security Solutions that Combine Productivity with Hyper-efficiency

Increasing productivity, even with a remote workforce, is a critical goal of many organizations. But with only so many working hours in a day, productivity gains rely exclusively on the efficiency of the tools being used. But in today’s environments, securing the proliferation of new applications is only part of the challenge for today’s firewalls. The volume of data being processed also needs to be addressed, and this is where traditional firewalls fall down flat.

Imagine a cutting-edge pharmaceutical research company looking to build new medicines while delivering value to shareholders. Testing, modeling, and 3D rendering are key to that process. These functions require the processing and transferring of very large datasets – often tens of Terabytes or more – as quickly as possible to AI/ML simulators. This enables new medicines to be developed faster, with lowered costs and reduced risk to human life. 

But that data also needs to be secured. The surreptitious injection of bad data can ruin months or years of research. And competitors and even nation-states may be looking to circumvent the time and expense of research by stealing this intellectual property. But without specially designed security hardware, few security devices on the market are able to keep up.

The FortiGate 4400F changes all of that natively by supporting multiple 100Gbps connections, enabling the inspection and protection of critical Elephant Flows by enabling organizations to make the most efficient use of their existing investments in 40G and 100G WAN links without compromising security at any layer of the network as defined by the OSI model.

But this is only the beginning. The next generation of smart cars, smart cities, and smart infrastructures – including transportation, power grids, manufacturing, and more – all augmented by AI and Machine Learning – will require the management and processing of massive amounts of Big Data. Providing sufficient performance and processing to support these new architectures will require even faster and more efficient infrastructures. And for most security vendors, this is a looming challenge that isn’t even on their drawing boards – which puts the future of the digital revolution at risk.

A Hyperconnected World Requires Hyper-Efficient Firewalls

The transition from 4G to 5G likewise promises huge potential for more efficient systems, the more rapid delivery of increasingly rich media, and a host of new applications and services still unseen that will benefit users and providers equally. But security is lagging from traditional security vendors still relying on off-the-shelf processors to power their devices.

Mobile network operators (MNOs) need a solution like the FortiGate 4400F that can ensure security and business continuity as 4G expands and they evolve their services to include 5G. The evolution of 4G and the introduction of 5G create the perfect storm for new levels of security performance and hyperscale needed to support the exploding number of devices connected to the mobile network. New security performance and scalability standards will need to be met to support the hyperconnected world where users talk to users and machines, where machine to machine communication becomes the norm, and data processing, decision-making, and transactions – often involving massive amounts of data – are measured in microseconds.

Likewise, mobile users adopting broadband wireless in 5G want very quick downloads of rich media, a very fast gaming experience, and the ability to generate ad hoc edge networks. Service providers need security solutions like the FortiGate 4400F to support and secure their massively scalable networks while ensuring fast user connection setup and the lowest possible latency. If not, the user experience will suffer, and revenue loss will follow as customers abandon the provider. 

Securing Data in Transit Remains Pivotal

Enabling providers to scale their radio access networks (RAN) and core infrastructures is already a challenge for nearly all modern security solutions. But adding the delivery of user data by leveraging hardware accelerated Suite-B encryption is an even more daunting task – and one that virtually every traditionally developed security solution fails to deliver. The FortiGate 4400F, however, delivers tens of thousands of tunnels while delivering 420Gbps of IPSec throughput, combined with a security compute rating of 11X better than other solutions for Security Gateway (SecGW) deployments. The versatility and performance of FortiGate Network Firewalls really futureproofs company investments because solutions like the FortiGate 4400F enable them to build high-speed, high-performance Data Center Interconnects. For situations that require encrypting at high speeds, IPsec can be turned on non-intrusively to support high-bandwidth IPsec tunnel flows.

Hyperscalability is as Essential as Hyperperformance

Performance is only half of the equation. Scalability is equally essential. With the greatest vertical scaling capability within a 4RU form factor, the FortiGate 4400F not only supports a very high influx of connections – 10 million connections per second and a security compute rating of 12x – it also reduces power cooling and rack space while offering the industry’s best price performance. And even at that level of scaling, you can still turn on essential Layer 4 firewalling and layer it with volumetric-based DDoS (distributed denial of service) attack prevention without impacting performance – ensuring all of your services are protected from bad actors.

Best-of-Breed Advanced Layer 7 Security for Everyone

FortiGate 4400F offers SSL inspection, including TLS 1.3, that is 6.5x better than competing products to provide full visibility into threats that hide in encrypted channels and the ability to detect unsanctioned applications. Inspection alone, however, is not sufficient. A strong security posture requires both threat protection and detection, and the FortiGate 4400F not only delivers two times the threat protection performance of its competitors, it is also powered by AI-enabled FortiGuard and FortiSandbox services to detect and stop known and unknown attacks. FortiGuard Labs has discovered a whopping 890 zero days – more than most competitors combined – with 104 detected so far just in 2020.

Hyperscale and hyperperformance are table stakes in our new digital world, and the new FortiGate 4400F provides these at a price-performance ratio unmatched in the industry. As organizations plan to move aggressively into the next phase of digital innovation, having a high performance security tool such as this in place is essential so that they never have to make the choice, now or in the future, between being competitive and being safe.

Read more about the announcement and how the FortiGate 4400F delivers security for hyperscale data centers with the industry’s best total cost of ownership (TCO). 

Customer Perspectives

Organizational growth often leads to the rapid expansion of the workforce and the addition of branch offices. This, combined with the transition to a teleworker environment, can place significant demands on existing infrastructure in terms of bandwidth requirements, access control, and secure workflows and transactions that are not only multiplying but now originating from outside the traditional network. And WAN environments that rely on dedicated MPLS connections become increasingly expensive while providing limited flexibility and functionality when it comes to things like cloud access, security, and application performance.

Large distributed enterprises in the manufacturing services industry understand more than most the need for business agility. In today’s increasingly competitive digital marketplace, they need to stay connected to anticipate and respond to shifting consumer demands, provide the best possible experience to their customers, and address the challenges of providing a robust work environment while maintaining reliable business continuity in a time of digital innovation and increasing cyber threats.

SD-WAN to Achieve Business Agility

One large manufacturing and services organization, with a single dedicated WAN link at every branch location, began experiencing frequent outages that had a severe impact on their workforce and customer experience with business-critical applications. Such connectivity issues, especially in an industry that relies on continuously managing the delicate balance between supply and demand, can negatively impact customer satisfaction and business outcomes. 

With over 1,200 employees, and a distributed infrastructure across eastern and central Europe, this organization’s branch offices also had a wide variety of connection types in place, with some branch offices using MPLS/satellite, others using DSL, and a majority using LTE as their only available link for data center connectivity and internet access. 

To sustain and accelerate growth, this organization needed continuous connectivity. In fact, it was a top priority for their Digital Innovation strategy. They also understood that they needed to augment their existing WAN links with LTE backup across all branches to support an active/active load balancing and failover architecture designed to maintain business-critical applications such as Point of Sale, camera feeds, and automation tools. 

They were keen on adopting an SD-WAN solution best suited to their flexible deployment needs. This included a solution that combined connectivity and security through a centralized management interface, application awareness combined with high-speed SSL inspection, and local breakout security for direct cloud access from each branch office. In addition, visibility and control needed to extend across all branch networks, combined with precise segmentation for security policy enforcement across users, applications, and devices. 

Fortinet’s Secure SD-WAN solution fits all of these requirements, and much more.

Fortinet’s Secure SD-WAN Solution for Digital Innovation

With several SD-WAN vendors vying for selection as part of their proof of concept trials, this organization was quick to discover that Fortinet’s robust Secure SD-WAN solution differentiated itself by providing a fully integrated solution that combined business agility, optimal connectivity, strong security, and best user experience into a single form factor that was easy to deploy and manage. 

Fortinet Secure SD-WAN offered hybrid WAN traffic steering, QoS prioritization, application acceleration, and automation combined with a robust Next-Generation Firewall that supported a full stack of enterprise-class security functions. And it was available as a consolidated, powerful desktop appliance that also included built-in LTE. As a result, this organization was able to validate that the Fortinet solution would support all use cases for their current business needs, as well as future innovations—something no other vendor was able to do. 

Secure SD-WAN Key Benefits

A few of the key benefits and immediate business outcomes provided by Fortinet’s Secure SD-WAN solution include:

• Deep Integration Combined with Product Consolidation: The needs for LTE as primary (replacing satellite-based MPLS links) and secondary links were easily met with FortiGate 40F-3G4G appliance with built-in LTE and the custom-built SD-WAN ASIC chip, the SOC4. And because these appliances include a full stack of security tightly integrated with advanced SD-WAN functionality, they were able to reduce the number of devices that needed to be deployed at each branch office. And with support for active/active load balancing and failover, they could provide consistent connectivity across all branch offices to ensure the best possible performance for their business-critical applications. 
• Best User Experience: Given the nature of their manufacturing business, their goal was to deploy a streaming camera video feed in the near future aimed at providing connectivity and access control at their branch locations. Fortinet Secure SD-WAN’s ability to prioritize high bandwidth applications and ensure better access control with its branch-to-branch VPN overlay ensured the best user experience combined with reliable, uninterrupted service.
• Strong Security Posture with Intent-based Segmentation: Secure SD-WAN’s ability to natively support intent-based segmentation enabled this organization to achieve better protection for direct access to cloud and internet resources while enforcing security policies based on the roles of users, devices, and applications. This, combined with a comprehensive, centralized content inspection to provide visibility into traffic, enabled the organization to limit breaches to specific network segments by preventing malicious content from passing over from one network segment to another.
• Flexible Deployment with Advanced Networking Support: By combining zero-touch deployment for ease of deployment with advanced networking functions, such as advanced dynamic routing with BGP, allowed this organization to seamlessly deploy the Fortinet solution at their data centers, disaster recovery hubs, and many of their branches without having to redesign existing network configurations.
• Extending Security to Branch Networks with SD-Branch: For those branch offices where outages were not an option, the organization was able to quickly implement hardware redundancy with active/active FortiGate appliances, and securely extend direct internet access via LTE using FortiExtender.
• Centralized Management and Reporting: Fortinet’s unique single pane of glass management allowed this organizations to easily deploy Fortinet Secure SD-WAN at remote branch locations while maintaining a single, integrated security and networking framework. This reduced the need for additional IT staff while improving visibility and control across the entire network infrastructure.

All Objectives Met, and with Significant Cost Savings

Unlike most SD-WAN solutions, which require the deployment of multiple solutions, including a complex overlay of siloed security solutions, Fortinet’s Secure SD-WAN was able to meet all of the requirements of the multinational manufacturing organization with a single, easy to deploy and manage appliance. Not only were they able to meet their deployment goals, but they also managed to reduce their capital and operational expenses at the same time. That’s because Fortinet offers to most robust and complete SD-WAN solution in the industry.

Take a security-driven approach to networking to improve user experience and simplify operations at the WAN edge with Fortinet’s Secure SD-WAN solution.

Read these customer case studies to see how De Heus and Burger King Brazil implemented Fortinet’s Secure SD-WAN to alleviate network complexity, increase bandwidth, and reduce security costs.

Engage in our Fortinet user community (Fuse). Share ideas and feedback, learn more about our products and technology, or connect with peers.

Customer Perspectives

Distributed enterprises are increasingly shifting data, applications, and workflows to the cloud to meet evolving business requirements and achieve digital innovation goals. However, this can become problematic for branch locations that still rely on traditional MPLS connections to backhaul traffic through the corporate network.

Fortinet recently worked with one organization struggling with this challenge and chose to leverage Fortinet’s robust Security Fabric platform and the Secure SD-WAN solution to address this.

New Requirements for a Distributed Infrastructure

With nearly 100 branch offices, this European automotive company sought a vendor that could secure their entire distributed infrastructure—from their data center to branch locations, to the Azure Cloud. This organization wanted more than just individual security tools that could protect each piece of their environment. They asked for an end-to-end solution that could provide robust security and connectivity across the entire network, and that could all be managed from a single console.

Various vendors presented their solutions to this organization, but they either lacked the security platform approach desired or the robust Secure SD-WAN functionality required. With key advanced networking features like centralized management and local inspection and control of network traffic at the branch, Fortinet’s broad, integrated, and automated Security Fabric was the only solution to check each box on this company’s list—meeting and even surpassing their expectations.

The result of almost 20 years of innovation, the Fortinet Security Fabric is engineered to enable Security-Driven Networking, Zero-trust Network Access, Dynamic Cloud Security, and AI-driven Security Operations across the enterprise to help organizations achieve their digital innovation goals and protect the evolving attack surface. And with a robust Security Fabric ecosystem of hundreds of seamless third-party integrations, it can be readily extended throughout an organization’s security architecture while enlisting existing investments into an integrated security framework strategy. This comprehensive approach to cybersecurity helps minimize security gaps, while a single management console provides full visibility and control over the entire network. 

Fortinet Secure SD-WAN, a critical piece of the Security Fabric for this customer, combines security and SD-WAN functionality in a single device to provide enhanced cloud-based application performance, advanced routing capabilities, and enterprise-class security all working together as a single, integrated solution to improve user experience while protecting critical data and resources.

A Fabric Approach to Cybersecurity

With a platform approach to cybersecurity that was able to address all of the varied needs across its infrastructure, Fortinet quickly became the front runner for this organization. Fortinet cybersecurity solutions were able to address the following use cases for this customer:

• SD-WAN Functionality: This organization was able to leverage Fortinet Secure SD-WAN on the FortiGate NGFW to decrease the amount of MPLS traffic and subsequently reduce costs while establishing a comprehensive security strategy that did not require building and deploying a separate security overlay. Moreover, its ability to provide local inspection and control of network traffic at the branch without requiring additional devices set Fortinet apart from the competition to this company that prefers the use of local breakout connections to access SaaS services.
• Dynamic Security for Cloud-based Applications: Fortinet Secure SD-WAN not only provides application identification, multi-path control, and application steering to ensure that organizations can access all critical applications and resources in the cloud, but the entire connectivity process is protected with a full stack of security solutions designed to automatically adapt to highly dynamic connectivity environments.
• Optimizing Connectivity with Azure: Fortinet’s Secure SD-WAN integration with Azure Virtual WAN offers a robust, secure and optimized Cloud On-Ramp to Azure Cloud workloads and services. This helps ensure ease of use, security, quality of experience, and visibility across distributed infrastructures spanning on-premises locations and Azure regional data centers. 
• Branch Security: This company also leveraged Secure SD-WAN to provide better security across their branch offices. SD-Branch added such functionality as access control for both wired and wireless APs, and protections for onsite IoT and endpoint devices and local LAN infrastructure, thereby increasing visibility and control without requiring additional IT staff on-site. 
• Time Saved: With Fortinet’s simple, single-pane-of-glass management console that can scale across their entire SD-WAN deployment, the security teams were able to save time deploying, managing, and orchestrating policies across all security devices.
• Integration: Having recently invested in solutions with Sentinel One, this organization needed a security vendor that could seamlessly integrate with them. Fortunately, Sentinel One is part of Fortinet’s robust Security Fabric ecosystem, with over 360 technology integrations. 

The combination of all these capabilities set Fortinet apart from the competition, making us the obvious choice for an organization looking to protect its infrastructure from its data center out to remote branch locations and across their cloud environment.

Take a security-driven approach to networking to improve user experience and simplify operations at the WAN edge with Fortinet’s Secure SD-WAN solution.

Read these customer case studies to see how De Heus and Burger King Brazil implemented Fortinet’s Secure SD-WAN to alleviate network complexity, increase bandwidth, and reduce security costs.

Engage in our Fortinet user community (Fuse). Share ideas and feedback, learn more about our products and technology, or connect with peers.

Customer Perspectives

Organizations are continuing to expand and are looking for ways to secure their multiple network locations. There are various challenges to overcome and consider to protect the entire attack surface from internal as well as external threats with advanced security. The digital attack surface is expanding at a rapid rate, making it increasingly difficult to defend against advanced threats. The search for and selection of the right solution that provides comprehensive security is imperative for these organizations aiming for a strong security posture. To achieve this, organizations require a strategy that brings security to the forefront of the network buildout and seamlessly integrates it with the networking stack. The goal is to enable network security practitioners to manage all security risks that are associated with applications and infrastructure in today’s hybrid data centers.

In particular, one specific organization – a cooperative of school boards in primary and secondary education – needed a network security platform that can provide comprehensive threat protection for thousands of primary and secondary schools in multiple network locations. This organization required a solution that could provide IPsec secure access from any school to their data centers and perform a content inspection as traffic leaves for, and enters back from, the Internet. Finally, they also wanted to take their security to a whole new level with advanced security detection and enforcement between all schools – within or across various school boards. 

Delivering High Performance and Advanced Network Security Across Multiple School Zones

In this instance, this large cooperative of school boards selected a security strategy and solution that would enable each education facility to have high-bandwidth internet access with advanced security protection across its numerous locations. This organization’s vision was to serve the needs of almost a million students by building a network that provides massive scale and performance for security and advanced networking capabilities that work together to provide a strong security posture. In addition to reliably securing the numerous school locations, the solution was selected by the group of school boards to lower IT expenditures by building a joint security solution that could benefit from economies of scale and offer a low total cost of ownership. The specific advanced security requirements include turning on application identification, web filtering, an intrusion prevention system, and anti-virus concurrently and having the data center capacity reach 715 Gbps of threat protection that consolidates all of the above-mentioned capabilities. Additionally, all of the existing and future schools that join this partnership will continue to connect using IPsec capabilities to the established data centers. 

Choosing the Right Security Solution to Address Several Complex Business Requirements

This education organization manages two large national data centers – a primary and a secondary data center working in an active-passive arrangement. The participating schools are spread across different school districts that connect to the primary data center using an IPsec tunnel that originates from a FortiGate CPE. The schools route all traffic via the primary data center and when that data center is inaccessible, they automatically fail over via the backup IPsec tunnel to the secondary data center, providing the required performance and reliability. In this scenario, these IPsec tunnels from each school are terminated on a FortiGate Next-generation Firewall that is placed in each data entry as a VPN concentrator. This allows all participating schools to securely backhaul traffic to the two data centers while preserving the confidentiality of the data. 

To ensure better access control, traffic between each school board is segmented using a FortiOS feature called VDOM (Virtual Domain). These virtual domains allow this organization to take a FortiGate and logically partition it, providing each school board the ability to create unique security and network policies that suit its needs while still participate in the knowledge sharing conglomerate of school boards.

The FortiGates seamlessly integrate advanced networking and security capabilities like application identification, web filtering, and intrusion prevention system capabilities for thousands of schools and enable a massively scalable network security platform offering the required performance of 715 Gbps.

This advanced security solution also provides traffic content inspection between any two schools that want to communicate with one another, including schools within the same district. This is paramount to building a strong cybersecurity posture for all schools that fall within this educational organization’s jurisdiction. Although performing SSL/TLS inspection (including TLS 1.3) on encrypted traffic for full visibility was not initially a requirement in the organization’s search for the right solution, Fortinet’s SSL/TLS inspection performance was seen by the organization as a key benefit of Fortinet’s security solution. Moreover, the organization had requirements for centralized management and reporting capabilities to reduce network complexity and risk, while increasing efficiency. By leveraging the Fortinet Fabric Management Center, which is composed of  FortiManager and FortiAnalyzer, this organization can benefit from single pane of glass management across their two data centers to reduce cost and complexity, and streamline operations. Additionally, the Fabric Management Center offers best practices for compliance and workflow automation to provide better protection against breaches.

Fortinet’s ability to build complex, massively scalable, and high-performance Layer 7 advanced security reduced the organization’s security complexity challenges, providing better visibility and heightened performance. True to its goals, the organization will be able to scale to 715 Gbps throughput for its sites within the next few years with the Fortinet solution. 

Furthermore, the organization will have the ability to leverage its existing investment in Fortinet solutions and can simply turn on built-in SD-WAN capabilities to employ additional broadband transports to their WAN infrastructure and preserve user experience while realizing the industry’s best investment protection.

Finding a Proven Partner in Fortinet

Networks are continually growing and evolving, and the adoption of new technologies or workflows can increase the attack surface and open the door to new threats. At the same time, cybercriminals are launching increasingly sophisticated attacks. For this cooperative of school boards, Fortinet provided the network security platform that could seamlessly integrate advanced networking and security capabilities, run multiple best-of-breed security services concurrently and deliver the required scale and performance with industry’s most optimized Total Cost of Ownership (TCO). With Fortinet, this organization will be able to protect up to one million students and has an effectively future-proofed investment that gives them the ability to turn on TLS inspection and Secure SD-WAN on their already deployed FortiGate infrastructure.

Find out how Fortinet’s FortiGate Next-generation firewalls provide organizations with application control, intrusion prevention, and advanced visibility across the network.

Engage in our Fortinet user community (Fuse). Share ideas and feedback, learn more about our products and technology, or connect with peers.

SASE (Secure Access Service Edge) has become a topic of increased industry discussion and interest for enterprises and partners alike. That’s because today’s organizations require immediate, uninterrupted, and secure access to network and cloud-based resources and data – especially business-critical applications – no matter where their users are located.

Digital innovation creates new challenges for organizations, including dynamically changing network configurations and the rapid expansion of the attack surface. This has resulted in new and incremental opportunities to provide additional levels of protection and access control that these organizations and users require. These are challenges that a SASE solution is designed to address.

However, there are two critical things to remember about the selection and implementation of any SASE solution. The first is that it must be easily integrated into your larger security strategy. If not, you are simply creating yet another set of stand-alone security solutions that require additional attention and resources. The second is that any SASE solution must not only meet current access and flexibility needs, but it must also support a Security-driven Networking strategy so it can quickly and automatically adapt to new network changes and evolving business requirements as they occur while providing robust, continuously-improved security and performance.

Fortinet Delivers the Most Complete SASE Platform on the Market

Because of the broad range of technologies it encompasses, and the variety of environments it needs to support, SASE is not a one-size-fits all secure access solution. Organizations have unique needs, and they need to be able to select and deploy those security offerings that are best-suited to their unique network environments and business requirements.

And yet, for SASE to work well, all of its components still need to interoperate as a single integrated system – connectivity, networking, and security elements alike. Part of the reason that sounds so familiar to us at Fortinet is that we have been delivering the core SASE requirements—plus much more—for years as part of our integrated Security Platform and Security Fabric architecture. A number of our customers looking to understand SASE have found that, with minor adjustments, they already had a SASE solution in place thanks to the power of the Security Fabric.

And now, to expand on the SASE flexibility and functionality already provided to customers and partners, Fortinet today announced the acquisition of OPAQ Networks, a SASE cloud provider. OPAQ’s Zero Trust Network Access (ZTNA) cloud solution protects organizations’ distributed networks – from data centers to branch offices, remote users, and Internet of Things (IoT) devices.

By combining Fortinet’s Security Fabric with OPAQ’s patented ZTNA solution, Fortinet further enhances its existing SASE offering to offer the best-in-class SASE cloud security platform with the industry’s only true Zero Trust access and security solution. It does this by integrating industry-leading next-generation firewall and SD-WAN capabilities, web security, sandboxing, advanced endpoint, identity / multi factor authentication, multi-cloud workload protection, cloud application security broker (CASB), browser isolation, and web application firewalling capabilities with a patented zero-trust cloud architecture to offer a flexible and dynamic SASE solution that can be managed and controlled through a single interface. 

And Fortinet has the R&D scale and focus to deliver continuous innovation, with the best and broadest security “under the hood.” Unlike other cloud providers, who are missing a strong security backbone or a scalable, high performance cloud architecture—or, in some cases, both—Fortinet delivers cloud security, with the security.

“The acquisition of OPAQ further enhances our existing SASE offering. Now, we will deliver the most complete SASE platform on the market with the broadest security offering, industry-leading SD-WAN, and advanced networking solutions to customers and partners through a flexible, cost efficient, and patented zero-trust cloud architecture,” shared Ken Xie, Founder, Chairman of the Board, and CEO of Fortinet.

Moreover, OPAQ’s platform is purpose-built to be partner friendly, empowering MSSPs, carriers, and high value-add partners to easily integrate its multi-tenant SASE platform into their own offering. This enables these service providers to add critical value to their business and government customers through their Network Operations Center and Security Operations Center expertise and advanced professional services.

Given remote workforce trends, with exponentially more users, devices, applications, services, and data now operating outside of the traditional enterprise edge than inside, the integration of Fortinet’s broad Security Fabric with OPAQ’s cloud platform offers customers and partners even more choices as to how they can consume best-of-breed security. And it is yet another unique and differentiated way that Fortinet is empowering customers with the best, and truly integrated security and networking innovation designed to respond to evolving business needs in real-time.

Fortinet Enhances SASE and ZTNA Offerings with Cloud Delivery Enhanced Capabilities

With the OPAQ acquisition, unlike other cloud security providers, Fortinet delivers:

• The best of scalability, performance, and security compared to any cloud security vendor.
• A broad and integrated suite of cloud security solutions providing true Zero-Trust security, unlike other ZTNA providers who leave many unprotected gaps in the attack surface.
• A one-of-a-kind ZTNA solution that includes continuous security innovation at scale, leveraging Fortinet’s market-leading R&D talent to deliver security substance “under the hood.” 
• The most partner-friendly ZTNA offering in the market that remains true to Fortinet’s ongoing commitment to its value-add services partners. 
• Fully integrated security and networking, including Fortinet’s industry-leading SD-WAN, furthering the company’s Security-driven Networking approach.

To that last point, Xie added, “The recent SASE market momentum further validates our Security-driven Networking approach and underscores what we’ve been saying for years. In the current era of hyper connectivity and expanding networks, with the network edge stretching across the entire digital infrastructure, networking and security must converge.”

Today’s announcement of the integration of Fortinet’s broad and integrated security offerings with OPAQ’s SASE cloud platform delivers the most complete SASE platform on the market, enabling organizations to more rapidly and securely embrace digital innovation and compete more effectively in today’s digital marketplace.

Learn more about how Fortinet’s acquisiton of OPAQ Networks enhances its existing SASE offering, enabling Fortinet to deliver the most complete SASE platform on the market.