FortiGate NGFW Enterprise Firewall Implementation

A complete, from-scratch configuration of a new enterprise FortiGate NGFW as the organization's network edge, replacing an end-of-life firewall and re-establishing VLAN-based segmentation across two floors, Wi-Fi, and an isolated server room, while adding SD-WAN, multi-site Site-to-Site VPN, and SSO-integrated remote access.

I researched the platform and configured every layer of it myself, from basic hardening through VLAN routing, DHCP-based device allowlisting, SD-WAN across a dedicated leased line, Site-to-Site VPN to the cloud and other on-premises locations, and Microsoft Entra ID SSO for both remote users and firewall administration.

The organization's edge firewall, the device every user in the office relies on daily and the boundary protecting a network already segmented into VLANs from an earlier initiative, was reaching end of life. Its replacement needed to handle everything the network actually required: routing between two floors' LAN networks, Wi-Fi access points, and other devices, while keeping the on-site server room isolated and unreachable from the rest of the network.

Beyond basic connectivity, the organization needed remote users to connect securely through VPN with proper access control, secure Site-to-Site links to both the cloud environment and other on-premises locations, and efficient use of a leased line alongside its other internet connections rather than relying on one line for everything. None of this could simply be copied from the old firewall; it had to be designed and configured from scratch on the new platform.

1. Researched the specific firewall platform and how to configure it for the organization's requirements, combining that with existing knowledge of the on-prem network and the VLAN-based segmentation already in place from an earlier initiative on the previous, now end-of-life, firewall.

2. Started with basic firewall hardening and enabled SSO on the firewall's own admin login before touching anything else, so the device itself was secured before any traffic-facing configuration began.

3. Configured virtual interfaces and linked each one to its corresponding VLAN, re-establishing and extending the segmentation the network already relied on.

4. Set every inter-VLAN route to go through the firewall and be rule-based, so the IT team controls exactly which VLANs can reach which others, rather than VLANs routing freely between themselves.

5. Configured the firewall's own DHCP service to hand out addresses only from a predefined pool, and only to explicitly allowed devices, so an unrecognized device connecting to the network doesn't receive an IP address at all.

6. Set up link aggregation between the firewall and the management switch across multiple interfaces, so the connection could handle full network load without a single link becoming a bottleneck.

7. Connected the full local topology through the firewall: both floors' LAN networks, the Wi-Fi access points, and other network devices like printers, all landing in their correct VLANs.

8. Gave the server room its own isolated zone, with access restricted from every other network rather than reachable the way general office VLANs are, since it's the most sensitive part of the premises.

9. Configured remote access VPN so every user connects through a VPN client rather than any other path into the network, with access controlled by rules and authentication handled through Microsoft Entra ID SSO, the same identity source used for admin login.

10. Set up Site-to-Site VPN tunnels from the firewall to both the cloud environment and other on-premises locations, so those connections are managed under the same security policy as the local network rather than as separate, unmanaged links.

11. Configured a leased line on its own dedicated interface for traffic that specifically required a static IP, with the rest of outbound traffic balanced across the other available interfaces, an SD-WAN setup using each connection for what it's actually suited for instead of routing everything through one line.

12. Rounded out the configuration with NAT for the Site-to-Site VPN traffic, and DNS and DHCP server configuration to support the whole environment.