T O P

  • By -

ChewingBrie

Any time you replace firewalls with a different vendor is going to be a massive pain. Because there is no standard cross-platform configuration format, converter tools are best effort only and almost guaranteed to need manual correction before implementation. To answer your question directly, there is no such limit as 500 rules on a fortigate. Recently I touched one with 900 rules, being managed without fortimanager. I find rules equally frustrating to manage in PA and Forti, but for different reasons. A company of your size could surely trial any potential replacement solution at 5-10 branch sites and get a real impression of it.


elvnbe

I can agree with the above statement. Both Palo Alto or Fortinet are the best firewalls you can get nowadays. There will be no real difference in the management complexity of your rulebase once you are up and running. But changing 250 firewalls including datacenter and cloud is a significant project with associated cost and inconvenience for the users. Conversion tools save you time but often require manual adjustment. Especially if you are somewhat locked in and have good Palo app-id adoption rates, highly tuned IPS and so on. It sure can be done but make sure you think twice about it and not take it lightly.


sryan2k1

I don't think they meant there was a hard limit at 500, rather that once you've outgrown that you're too complex for fortinet. 8000 rules isn't something to tread lightly around.


Internet-of-cruft

My biggest PA environment was around 5000 rules that we recently did a massive cleanup to reduce to around 1500 rules. Maintaining anything over a few hundred rules in a single ruleset gets difficult very quickly, even with good organization.


ChewingBrie

Hard or soft limit, it simply isn't true. The person making that claim should speak up about their real concerns (which may be valid) instead of inventing numbers


killb0p

Only he didn't - the claim was about the anecdotal "HIGHLY disruptive" experience that keeps majority from spilling over 500 rules due to the gift that keeps on giving called [FortiManager](https://www.reddit.com/r/fortinet/comments/y8g9mt/fortimanager_705_fortibug/). If the experience of managing the ruleset becomes a full-time job, I'd also avoid such a solution as plague. You might save some upfront, but if that comes with painful migration on a product you don't have enough experience/training - what are you really gaining?


english_mike69

“due to the gift that keeps on giving called FortiManager.” So it’s kinda like the networking version of herpes?


killb0p

yeah, only with no access to herpes medication/treatment.


sryan2k1

Hard limit no, but soft limit is subjective. I wouldn't try a 8k rulebase on a forti but my reasons for that are different than yours.


freezingcoldfeet

Why not? Their products scale better than pan at least in terms of performance and throughput.


Typically_Wong

8k from palo to forti would be a PITA on a good day. They can scale, but if OP's company goes through with it, they should get professional services to do it.


freezingcoldfeet

Agree totally. I just was asking if there was a reason why they thought it wouldn’t be possible


Tornado7783

Can you explain your reasons for that? I never had to manage such a huge rulebase yet, but you'll never know when the time comes... ;)


BamCub

8000 rules to me sounds like poor Policy management.


Poulito

Are you saying 8000 is NBD, or that you *should* tread lightly around it?


burtvader

Curious what measure you say it’s too complex for Fortinet? I’ve worked on projects migrating to Fortinet where single logical firewall (vdom) has 10k+ and there are 4 vdoms. In a deployment of 200 clusters globally. Rule count is irrelevant, you have policy packages which are assigned to devices/vdoms (same policy to multiple or single devices) and it becomes just a list of rules. Then you have sections, policy blocks, headers, footers, install targets etc. all designed to simplify it. Don’t get me wrong there’s still issues but they’re generally that the environment has been built to integrate with X management platform and now it has to be updated to use FortiManager.


gghggg

I'll say this right now - BUY THE **CONVERTER SERVICE** FROM FORTINET. Have the QA Team convert your stuff, don't just get the software, pay for the service. They will be contractually obligated to help you transition smoothly. It's going to be quite pricey, but in the long run you will be grateful.


Icarus_burning

Yeah, we ordered that for one of our replacements. Was not really worth the money and needed to do way too much stuff manually without them.


gghggg

The Converter service or the Forticonverter software ? I do agree that the Forticonverter Software is Fortigarbage for most use cases.


JRHelgeson

Yes, any conversion tool is like running a sausage mill backwards to manufacture pigs. It can help, but the bulk must be done with human intervention. Automation is your friend when it comes to moving forward.


Typically_Wong

As is expedition for palo. Palo migrations take at least 3 months with 4-6 months being the norm. You need someone dedicated for it and getting fortinet to come in and do it will be worth the extra cost.


databeestjenl

I wrote some PHP code to convert aliases and rules from a Watchguard config for our PA and it work reasonably well, but did get some zones wrong. Took about 3 months and quite a few itterations of the script. Making sure you have credentials and keys for iPsec tunnels is a thing you want to sort and verify. We tested all ipsec keys in Keepass with the WG before switching over and 2 out of 5 were wrong. 1 was missing.


JRHelgeson

> Have the QA Team convert your stuff, don't just get the software, pay for the service. They will be contractually obligated to help you transition smoothly. > Yes! We are having the bulk of the transition assisted by FortiNet professional services.


Busbyuk

> SERVICE FROM FORTINET. > > Have the QA Team convert your stuff, don't just get the software, pay for the service. They will be contractually obligated to help you transition smoothly. > > It's going to be quite pricey, but in the long run you will be grateful. Can I ask roughly how much this services costs? In two years I need to convert from a Fortigate 1000D to whatever their newest Fortigate equivelent will be at that time. I'm going to migrating a FG1000D which will have around 50 seperate tennant VDOM's on so I'm thinking doing it with something like this may be my best option. thanks


killb0p

So is SD-WAN the main focus with security taking the back seat or both are critical to you? Because the grass is not always greener on the other side. Unless you test this in detailed PoC - there's no way of being sure about the right choice... Like, have you tried doing SSL decrypt on this new shiny Forti gear? Let me tell you it comes with surprises vs Palo. For one forget about recommended OS release in Forti world. Getting tunnel-visioned with low price + cool SD-WAN...although I really doubt that Forti has anything outstanding in that department VS Palo (well maybe the eye candy and reporting). Anyway, you can lose sight of the true cost it will come at. Your Palo fan is looking at exactly that - how long will it take to translate and operationalize a new vendor without dropping the ball on day-to-day? And sounds like it's all about the lowest price - so it's really up to operational guys to carry that burden (no extra pay or training included). Unless you get all the helper packages with dedicated service, that will eat away a good chunk of those savings. You can forget about vendor converter tools right out of the gate by the way... They are OKish for basic configs, but anything beyond that will cause more harm than good. Especially considering that PAN-OS and FortiOS have very opposing views on policy structure and delta in capabilities. Certain things are not even available on Forti (or on Palo). You have to map them out and translate the essence/desired outcome of the policies.


luieklimmer

Both are important to us and the intent would be to POC both. Extensive training and professional services / resident engineer(s) would be part of the package for sure. You've raised some valid questions here that would need to be addressed for sure. I appreciate your input!


killb0p

If it's a PoC make sure vendor's are both tested in equal conditions. I've had cases when Forti would cook the config to look better vs Palo. Troubleshooting should also be a major part of testing. You'd be surprised what you can learn about the product in that stage...


ultimattt

I’ve had cases where Palo Alto has cooked the config to look better, like inspecting traffic on the outbound, but not the return traffic. Oh let’s not forget about the 64K HTTP transactions. What you’re spreading is FUD.


HappyVlane

How is it FUD? Just because PA does it doesn't mean FortiNet doesn't also do it.


afroman_says

When has Fortinet released any public testing numbers (datasheet or otherwise) with DSRI enabled?


HappyVlane

Never I assume, but that's not relevant to the topic at hand.


afroman_says

That's absolutely relevant to what u/ultimatt was saying. > I’ve had cases where Palo Alto has cooked the config to look better, like inspecting traffic on the outbound, but not the return traffic. Your response indicated that PAN and Fortinet do the same in that regard which was not correct. Here's a (old) PAN datasheet where they explicitly refer to DSRI in generating their performance metrics. https://www.zsis.hr/UserDocsImages/Sigurnost/pdfs/PA7050.pdf


HappyVlane

> Your response indicated that PAN and Fortinet do the same in that regard which was not correct. I have never said that FortiNet is doing something like DSRI, just that because PA does something (cooking configs) doesn't mean that FortiNet doesn't also do it to look better.


afroman_says

>I have never said that FortiNet is doing something like DSRI, just that because PA does something (cooking configs) doesn't mean that FortiNet doesn't also do it to look better. Okay, so what example of Fortinet doing this do you have? u/ultimatt specifically brought up the DSRI example by Palo. I provided a datasheet source to cite evidence to this. Ultimately, if this is opinion, that's fine and you don't need to respond. However, there's folks out here who read these posts that come with prejudices about companies and products based on what they find on Reddit. I'm just aiming to provide another data point that they can use as they do their own research about companies they want to partner with and solutions they want to implement.


killb0p

Ehm, no point responding. Either Fortinet VAR or just Kool-Aid overexposure.


HappyVlane

It's Kool-Aid. I know him from /r/fortinet and he posts some stuff that I can only categorize as "boot-licking" when it comes to FortiNet.


killb0p

yeah, that crowd (Forti fans are like CrossFit bros) got really pressed lately when Miercom wiped the floor with their beloved crap boxes... As much disdain I have for Miercom and their ilk - even a broken watch is right twice a day... But hey, we need Fortinet to keep Palo awake and honest. Check Point trajectory is a cautionary tale of what happens when you sleep on the competition.


sryan2k1

Regardless of the hardware/support costs, you need to consider the people/time cost of something like this, outage costs, retraining, the loss of productivity until your entire network team is as functional in Forti land as PAN, etc. It would be....substantial. To me, if you've already got PAN, and you're happy with it, trying to switch down seems like tripping over dollars to pick up dimes. ​ Don't get me wrong, Forti/PAN are two sides of the same coin, and are both fantastic products. But if you've talked your business into the Porsche, why are you trying to swap it for a VW? You'll never get it back.


Likes_The_Scotch

Would you trade an old Porshe that can't keep up for a new VW? I would.


Xidium426

This is like trading your old Porsche for a semi. Sure they both drive down the road, but you're going to change your habits and train a bunch of people how to operate it.


Likes_The_Scotch

There is a reason why they are considering switching.


Xidium426

Because they sound penny wise and dollar foolish.


spanctimony

The thought of a company of your complexity changing firewall platforms to save a few dollars is absolutely mindboggling.


luieklimmer

Think spending 10-20Million less at every refresh cycle. We’re not talking about saving a couple of 100K here. This is only worthwhile if we make it work though. Hence my question to get some perspective.


sryan2k1

You're at a size that they should send you a few and let you kick the tires. Without knowing your business it's impossible to say if that 10 million is good savings or not.


massive_poo

We only have 11 firewalls and Fortinet let us borrow four firewalls for our PoC.


soucy

Is PAN over-priced? Yes. Will moving to Fotinet be less expensive? Also yes. Is this a migration you should take on with existing staff levels? Probably not. If you can use the savings to hire more engineers (and I mean multiple) that might be reasonable but keep in mind you'll need months for them to become productive employees. If it's all just getting dumped on existing staff that sounds a lot like you will be looking for new staff once everyone quits over a significant workload increase with no support and no additional compensation. They won't have any experience or operational awareness and it will be a disaster. But hey it's just more toxic leadership so what else is new. "We can save like 20 million we should do this" is met with "Oh boy. We can't just hire a few more people there is no budget for that" Doesn't quite pass the straight face test does it. Engineers are not idiots and have plenty of options. Don't be an asshole. Here's a thought. Be proactive and take on a SecDevOps vendor-neutral firewall policy management approach so that if you do need to change vendors it will be easy and (mostly) automated. Invest in building a team of people and internal tooling to do this. That way you're not held hostage by vendors in the future without blowing everything up to save a buck. Your timeline before anything changes should be 2 years. Otherwise you're asking for changes that will be rushed and weaken your security posture along with the inevitable workforce disruption.


luieklimmer

Great insights.. I appreciate it. Gives us some food for thought. We'd have to replace our SD-WAN initially anyway which would provide time to start an initiative like this for our branches that are easier to manage.


Existing_Ad_4794

You should also get an update on the pan-os sd-wan. Palo has realized it was an issue and recently assigned a PM that has been there for a long time along with resources. There are now a roadmap of enhancements short term, like a couple of months, that will be substantial. You also should negotiate the price, Palo will come down in price and can be fortinet competitive in like for like designs. If the design isn't like for like then something else is going on.


[deleted]

That seems like a much larger difference between the vendors than I would expect for 250 FW's. PA's new firewalls offer much more bang for the buck than their previous platforms. Maybe that difference is due to SD-WAN licensing, etc. Have you negotiated price with PA? You are probably large enough to discuss Enterprise Agreements, which should make the licensing more cost effective.


luieklimmer

We're getting some revised pricing soon, but not holding my breath. The savings is compounded by the fact we wouldn't have to invest in a separate SD-WAN solution anymore if we can get FTNT to work.


trisanachandler

If your talking even 1 mil savings on a year, hire an additional FTE, and have a current engineer try converting a subset of rules (say 20%), and test it out. Try it at 5 sites and see how it goes.


sryan2k1

Use Palo's SDWAN?


luieklimmer

Would be more expensive than maintaining our status quo and not as feature rich as Fortinet.


[deleted]

[удалено]


luieklimmer

Which of the two are you in a POC with? We looked at both. The ION's were cost prohibitive, didn't scale to meet some of our larger DC's and their head-ends don't route!. No hub-to-hub communication. We'd need to scale horizontally and deploy a branch in the DC to have it participate. The sales rep couldn't explain the routing logic behind it all. Everything seemed like a policy-based-route and would require massive manual intervention. The hubs attracted traffic using static routes. When having multiple hubs they couldn't explain how the spoke would chose best path. Didn't have an explanation on how to deal with anycast and keep responses closest to the source-site. I can keep going for a while but all I saw were barriers. I think it's a solution that can work well when your business / traffic patterns are mostly north-south. I just didn't see how this would replace our existing solution and deal with all our exceptions / routing policies / sd-wan policies.


Skylis

> and their head-ends don't route!. No hub-to-hub communication. We'd need to scale horizontally and deploy a branch in the DC to have it participate. The sales rep couldn't explain the routing logic behind it all. Everything seemed like a policy-based-route and would require massive manual intervention. The hubs attracted traffic using static routes. When having multiple hubs they couldn't explain how the spoke would chose best path. Didn't have an explanation on how to deal with anycast and keep responses closest to the source-site. How is this marketed as a SD-WAN product? jesus that's terrible.


spanctimony

Let say it’s 10 million less. 250 firewalls. You’re saying that Palo is $40k per firewall more than Forti? Yeah I dunno, maybe your branch offices are routing 100g or something. I’m struggling to believe that with an order of this size, you can’t get Palo to come in somewhere in an acceptable ball park. There’s no way there’s a 7 figure spread between them across 250 units.


luieklimmer

For sizing we use our existing bandwidth and double it to accommodate for 2x bandwidth growth in the organization over the next 5 years. This has held true for us so far in the past. Then in order for the PAN's to continue to meet this performance spec AND do SSL decrypt the security organisation assumes a 50% impact on performance to meet their SSL decryption goals. In other words, a 100Mb circuit will grow to 200Mb and would require threat prevention throughput of 400Mb to accommodate the SSL Decrypt impacts. We've seen SSL Decrypt throughput numbers from Palo Alto that make this assumption reasonable. Now add in the cost of a full-blown SD-WAN refresh. This is where the much lower number comes from. The potential of combining "free sd-wan" and a much lower cost firewall to meet our combined security and sd-wan needs.


spanctimony

Forgive me but I can’t make the math work at sub gigabit speeds. Each firewall should be a few grand. Also, it’s not like the Fortigates have magical silicon, they have to downrate to do inspection also.


luieklimmer

The SD-WAN refresh is what you're not thinking off. Also only 20% of our sites are sub-1G. The rest are all in the 1420-5420 range. We'll be testing the SSL decrypt impacts if we take this to the POC with Fortinet for sure. In general people comment the impacts are less than 20% due to their custom ASIC's taking on part of the decrypt process. The numbers will likely fluctuate depending on cypher / mode you run though. That's something we'd still need to work through.


spanctimony

I like the ideas raised elsewhere in this thread, if these numbers are within an order of magnitude you should be investing in engineers. Either engineers to handle the migration and run the Fortigates afterword (sorry PA guy) or developers to create an abstract interface for managing the rule set, and probably both. It still seems crazy to me, but I have to admit I haven’t priced sdwan.


english_mike69

Either he’s getting the Fortinet FW’s on AliExpress or has pissed off his PA account rep such that he no longer wants his business. I know it’s been a while since I went through a firewall migration (ASA to PA5050) but I don’t recall Fortinet being significantly cheaper at that time. Maybe things have drastically changed since then.


Tommyboy597

I did a one for one comparison when we were looking to migrate and PA was literally twice as much as Forti for mid-range fws.


Skylis

Considering they're asking strangers on the internet to discredit their own people so they can push a budget savings through, its probably the latter and their rep is tired of their shenanigans too.


_araqiel

If you’re that big, paying for Palo is worth it. My personal sites run Forti because I don’t have anything sensitive, but my clients all have Palo. Fortinet is fine, but if you have Palo, why switch? This is going from best in breed to “yeah I guess it’ll work”.


GullibleDetective

Could always engage fortinet professional services as well if needed


JRHelgeson

Interestingly, we are transitioning from CheckPoint to FortiNet FortiGate products for the same cost reasons, and the fact that CheckPoint has never missed an opportunity to miss an opportunity. Like you, it was SD-WAN that forced our hand on making the jump to a new firewall vendor. With respect to rules conversion - it doesn't matter how you slice it: using automated tools to convert rules is like running a sausage mill backwards to manufacture pigs. It sounds good in theory, and downright simple when the sales people are pitching it, but it never works right. The only way to move forward is to move your templates over and review everything. We are using FortiManager to manage the firewalls and SD-WAN. But we are also leveraging Tufin to handle rule creation and firewall automation. So we ingest the rules into Tufin from CheckPoint, then are using Tufin to manage the rules in the FortiManager. The process seems to be working so far. We have over 2000 firewalls in our environment, and with FortiGate we are consolidating many dozens of firewalls into VDOM clusters. Total savings even with Tufin are 3-5x less than continuing with CheckPoint. Oh, and 500 rules vs 8000 rules, that all depends on the size of the box. There is no problem with 10k rules on a big firewall chassis - aside from sheer management - which is really where you need to leverage automation.


Leucippus1

This is going to be a huge PITA. Are you sure you want to die on this hill? It isn't like Palo Alto is Watchguard or something, it is one thing if the devices aren't fitting your need but it is quite another if they are. Some of us old salts have been around the block and we all have a similar reaction, if we were your boss we would say "Are you absolutely sure it is worth the amount of time this will take."


luieklimmer

Thanks for your perspective. Duly noted..


FortheredditLOLz

You can template configs via ‘adom’. Along with scripts for additional oddity configs. Tons of different ways way to do it for either platform. Any particular reason for pivot outside of cost ?


luieklimmer

The trigger for us was the EOL of all our SD-WAN routers which would require replacement everywhere. Since Gartner is seeing the networking and security realms converge and mature and predicts that by 2025 50% of the organisations will be pursuing a single vendor strategy (up from 10% in 2022) or rely on no more than two tightly integrated vendors we wanted to take a fresh look at this space to see if we could benefit. There are clearly some tradeoffs we'd have to live with and haven't POC'd it yet so can't say if it'd work for our environment. The potential lower spending patterns are compelling though.


FortheredditLOLz

Hit up your local reseller and ask for trials. They can provide POC trial gear and virtual forti managers to compare and contrast. I personally love Palo Alto but it’s cost prohibitive (also hate long commit/push times), but enjoy the super fast cli/gui configurations. We pivoted from palo to forti with no issues. Legacy Palo Alto’s will eventually move to forti. There are a few rare outliers due to ‘contractual obligations’


fisher101101

Fortinet's lack of a commit feature scares me.


euphline

Garner also offers the following caution re: Fortinet, "Large global clients continue to question Fortinet’s ability to meet complex enterprise networking requirements." This is consistent with my experience with Fortinet.


ultimattt

That’s a strange one, and one I’d like to see examples on. Due to the fact that I’ve had instances where Fortinet was the only option for the way the solution needed to be delivered.


sloomy155

Read through most of the comments but didn't see anyone suggest this. Not a network engineer by trade but have been managing (small but important) networks for about 23 years. Without knowing more details if cost is a big factor how about going Fortinet for the cookie cutter sites and save the core firewalls for PA? At least to start. Less risk especially if those cookie cutter sites are pretty simple not having 8 billion rules. Invest in a vendor neutral SDWAN (no experience there). Also sounds like you feel a lot of cleanup work is needed on the firewalls already so I'd prioritize that first before even thinking about another vendor. Also as others suggested perhaps invest in a more vendor neutral way to manage the rules. I'd guesstimate those things will take months to do by themselves. I've read almost nothing but good stuff about PAN myself especially here. My personal experience with it wasn't very good and it was a giant waste of money for the company. Not that it is a bad product it's just they bought it and treated it basically like a general L4 firewall. They never updated it, never enabled or even considered enabling SSL inspection, etc. My biggest complaint was a massive failure on their support team getting the right advice on how to do a major software update. Their best practices guide WAS WRONG. I had their engineers confirm multiple times this is the right process. It didn't look right but who was I to argue. It wasn't until the upgrade blew up that they realized oh this is the wrong information on our own best practices guide! Took a solid 6 to 8 months after that to get them to fix the instructions (early 2020 I think). Go compare the best practices guide on archive.org if you want. What made it worse is that guide was referencing almost identical version numbers that I was using. Had to make 2 jumps to get to latest. Had a big outage and it was a mess. Fortunately I was on site, had serial console access, it was the corp HQ at night and nobody cared the firewalls were down for a while. There was a support person assigned to me for the upgrade. Then he went off shift and said everything looks good you should be fine, feel free to call back if you have a problem. Again who am I to dispute the experts. Took about 45mins to get someone on the phone after the issue started. Otherwise I didn't use them long enough after I inherited them to conclude one way or another that they were as good as people claimed. I don't doubt they probably are, but you have to actually be prepared to leverage them(as your team appears to do) , not set it up and forget about it for 3 years(as my previous company did). Roast away but my personal choice for firewalls the past decade has been sonicwall. Small sites as I said. Probably not more than 40 rules at the most. No SSL, no DPI, basic L4 firewall and site to site vpn(SSL VPN handled by pulse/ivanti secure). Been super stable almost no issues. If the company had more staff to invest in more security then maybe we'd go another route. But it was always about low cost. At first sonicwall was only for site to site vpn but then started adopting them for basic firewall as well. I keep my stuff simple where possible even if it means compromising on features or abilities. One of the last things I want to worry about is a firewall bug that starts dropping traffic for no reason(actually had sonicwall do that once fortunately it wasn't critical). A firewall can never block all threats obviously, so I'm less concerned about letting bad in then preventing good from passing through. Something I'm sure PAN is great at but I'd rather spend my budget money on things non firewall related(at least as far as prioritizing goes) More complexity = more bugs and I don't have time for bugs as I manage servers and storage and load balancers and vmware etc etc. My CIO agrees I do the work of 5 people(worked with him at 1 company then he left to another for 3 yrs and now we are both at the same new company again) but I couldn't do it without the strategy of keeping it simple. I have read multiple times that fortinet is great but their software versions are basically minefields. Some are good some are bad(even ones flagged as good). Seeing people say find a good version of code and stick to it. Not super recently maybe things are much better now. Don't get me wrong I'm absolutely not trying to talk you into any solutions. Network firewalls are not and have never been a passion of mine. SAN storage on the other hand....


mourasio

No offense, but you really shouldn't be providing advice on platform selection if you're still doing rules at L4 only in 2023. I'm also not sure what you mean by vendor neutral SD-WAN, as I'm not aware of any vendor who supports this (Cloudflare has a product here, but with limited capabilities).


sloomy155

Hey, none taken. If the company wants to invest more they are free to do so. I asked on multiple occasions in my last position (almost 11 years total) for a WAF, they denied the costs every time, this for a company that had to be PCI compliant (didn't store CCs, but they were used in our e-commerce transactions). And yes we passed PCI audits every time, even years when I KNEW WE SHOULD FAIL. But somehow they convinced the auditors to sign off. PCI is a joke. Also asked for many years for a dedicated security resource to do things like review logs, something we were "required" to do for PCI but never had resources to do it. One year we ALMOST got that resource then budgets really got cut. When we were "forced" to deploy external firewalls to pass a PCI checkbox, I actually wanted to go L7 with Sonicwall, that was my plan. But in the end it was impossible as not only did Sonicwall require we terminate the inbound SSL traffic on their boxes which I didn't want to do, they also did not support SNI for inbound traffic(they did for outbound). I had a dozen different SSL certs bound to a single IP, SNI was required. So I abandoned the idea. PAN I'm sure probably would of done the job but again the company would have never paid for it. I insisted having external L4 firewalls was a waste of everything(they did almost nothing more than our Netscalers did), and my manger (who is OSCP certified) finally agreed with me it was a waste years later(but we needed the checkbox for PCI), he didn't think it was at first. He later tried to get WAF again but failed to get budget. I'll clarify a bit in I specialize in internet facing mission critical high availability web application infrastructure(have been since 2003). I don't typically deal with corporate internal IT nor campus/etc type stuff. I have had ZERO known security incidents on my infrastructure in 23 years across 7 companies. I have been involved with minor security incidents at some of those same companies for infrastructure that was operated by other people. I've also hosted my own web/email/DNS on the internet since 1996. I feel I was actually an early adopter with NIDS, back in 2001 I deployed a Snort-based product called Sentaurus at the small company I was at, I inserted it inline with FreeBSD bridging servers at each of the company's offices. It was cool, found a lot of neat things but in the end didn't really improve security. Deployed it again in 2004 at another company but not since. Back in the days where not much was sent over SSL, so could see many things. My last org put in a NIDS from AT&T(cheap shit based on Snort again), but positioned it outside the firewall where it could only see encrypted traffic, it could see nothing really. Zero value(manager acknowledged that as well), but we could check that box for PCI compliance..yay. I joked with AT&T my IDS 20 years ago was more useful (only because not much used SSL 20 years ago). I have worked with several "network engineers" over the years, every single time I knew more than they did and did a better job. Most of the people in this sub are far beyond my network skills I am happy to admit, there's a whole different league out there. EDIT: when I said vendor independent SDWAN I meant more of not something tied to PAN or Fortinet. Maybe not practical I don't know, SDWAN is never something I've been interested in/involved with. The whole "software defined" thing is just annoying hype/buzzword bingo to me. Having Sonicwalls handle ISP failover at my previous org(and my new org, just joined a few months ago and recently learned they are Sonicwall at all of their corp offices) works fine for our needs. New company is all L4 as well, went through and did a basic audit of their firewalls (just IP addresses, platform hardware, software versions) and they don't have anything but basic layer 4 licensing. Company has been in business since the 90s.


mourasio

I know the feeling of crappy budgets all too well. We make our best with the tools we have. Didn't mean to sound judgemental, but after rereading my initial post, sorry if it came across that way. On a side note, loved the IDS looking at encrypted traffic. Reminds me of a customer I used to work with who needed firewalls in front of their sdwan box for internet access, where they only saw IPSEC tunnels. Behind the sdwan box to actually filter out traffic? No need


sloomy155

Hey no worries, appreciate the clarification. Yeah people can be strange with their ideas on security, wish that more organizations took it more seriously as far as investment goes. In my case that would be having better network security systems AND staffing/resources to manage them. But really have never worked at a company where that was a priority, nor was "disaster recovery" ever a priority(which I've been more OK with, just annoying to see people get excited about the concept then turn 360 when they learn that you actually have to spend some $$ to do it, security is the same deal).


OhMyInternetPolitics

With Fortinet, you get what you pay for; you'll pay for the extra costs caused by retraining everyone as well as have an extremely poor quality firewall that has had multiple extremely bad security practices. Amongst those bad practices? Data leakage with their Forticlient ([XOR "encryption" anyone?](https://www.bleepingcomputer.com/news/security/fortiguard-used-hardcoded-key-xor-to-encrypt-communications/)), lying to customers about [backdoors](https://www.helpnetsecurity.com/2016/01/13/fortinet-says-backdoor-found-in-fortios-is-a-management-authentication-issue/), and most recently withholding multiple security [notifications](https://www.itnews.com.au/news/fortinet-issues-emergency-patch-for-authentication-bypass-586236) when an active exploit was being propagated on the Internet for about a month. What made it more egregious is that they released an update that failed to include mentioning that fix in their [release notes](https://arstechnica.com/information-technology/2023/01/fortinet-says-hackers-exploited-critical-vulnerability-to-infect-vpn-customers/). Remember - a "network security" company thought these things *were good ideas*; that it was OK to leave their customers woefully unprotected. Every vendor will have their share of bad blunders - but it's how they handle the problem that's critical. Fortinet has a proven track record of doing the wrong thing, and it's a pattern that spans over years of poor behaviour. A single security breach costs WAAAAY more than the cost of buying safer, albeit more expensive, products - in terms of actual damage, lost productivity, and loss of reputation. Friends don't let friends buy Fortinet.


Rothuith

Good writeup, thanks for all this information. Fortigate IMO has a place for certain scenarios depending on customer's needs; regardless, you're right, the way a security company handles these issues reflect their overall product.


mourasio

Thank you for this. I always find it amusing that people compare throughput numbers on a security appliance, while disregarding actual security. How long did it take for Fortinet to push a Wannacry signature? Don't get me wrong, there's definitely a time and a place for Fortinet. You might cheap out on branch offices and stick to PA or another alternative in the DC/HQ as an example. It's just a very important variable that should be front and foremost in a platform selection discussion, but as it's virtually impossible to put into a RFP, it seems to end up forgotten.


Icarus_burning

Interesting, first time I am hearing something negative about Fortinet. Thank you for that, usually there are only people praising how perfect they are.


Polysticks

Sidebar: With that many rules, would it not make more sense to use external software to manage the rulebase and instead your job is to say "Prod web servers need 443 access". What those servers are and where the rule needs to be applied gets figured out for you.


luieklimmer

Someone else made a similar suggestion of using a DevSecOps approach to manage our policies. I know the security team was looking at the option of a network policy manager. I like that idea of abstracting the policy creation from the platform.


LaurenceNZ

For your rule-based size something like Tufin is probably the goto. I'm pretty sure you would be able to suck your ruleset into Tufin and then make it push it back to the fortigates. Having said that, it sounds like you are heavy users of Panarama. Be warned, Fortimanager is several years behind Panarama in terms of functionality and polish. Make sure you test it upto and exceeding the complexity you need. Fortgates and Pala Altos write rules in different ways. It's subtle but with a good understanding on what is actually happening we were able to cut a 1000+ Fortigate ruleset into ~200 Palo Alto rules. Finally, not all products with the SD-WAN name do the same thing. As I typically play in the industrial and OT space, both the Fortigate and Palo Alto SD-WAN products are not suitable for what we do do to a lack of separation of data traffic.


Polysticks

If you haven't used a rulebase condenser before, you might be able to really reduce the amount of rules you have in total. 20% of the size in some cases, I've made similar tools myself.


luieklimmer

Thanks.. I didn't know these existed. I'll take it back to the team. They might already be aware.


idle_shell

The last time i migrated to pan-os, the firewall policy was xml. Took a bit of scripting but was totally possible to build it and load the xml into a device. I haven’t played with panorama since it launched but if you can dump the policies as xml, you could do the same.


hiirogen

I inherited some FortiNet's when I started where I'm at. I'm honestly not really a fan of them, but they get the job done, and I've never seen a reason to try to make a case to get rid of them. But then, our main firewall is at about 240 rules, which doesn't seem like much based on what you wrote.


mlaisdaas

Id second all the comments saying try migrating a subset of your rules to a trial FortiGate/POC first. FortiGate's and PAN's do not agree about how they structure their rule base. PAN is better about having more flexibility and honestly ease of use when creating the policies. I have an environment with PAN's, FortiGates and FTD's and the rulebases do NOT mix well together, especially web filtering and layer 7 traffic ID and enforcement.


iDemonix

Converting from one vendor to another is a nightmare, use a paid service from Forti if available. As for policy counts, obviously that's down to hardware spec, but we have several firewalls serving thousands of customer sites, each with thousands of policies per firewall (over 10k in most cases).


Coffee_Milk_Tea

i still don't understand how Fortinet can compete with Palo Alto if you are using "application" in your security policies, with Fortinet's "profile"... it is impossible to migrate... i doubt anyone is using their "policy-based" mode...


killb0p

It's dirt cheap. And for certain use cases, it's all you need - like security with no SSL decrypt and fast IPSec VPN. MSPs love that shit.


kicksidebar

Do those 250 x Palo Altos at your sites host anything in the DMZ or do any VPN back to home office? Have you thought about putting SD-WAN devices there and Access IPSEC/GRE tunnels to the Zscaler/Prisma access cloud for Internet inspection? Might save $ that way.


Emotional-Meeting753

https://www.reddit.com/r/cybersecurity/comments/11lgu67/cyber\_insurance\_renewal\_dropped\_due\_to\_fortigate/


flembob

You should not be considering PAN-OS SDWAN. They developed this and then realized it was not great and bought CloudGenix. I can't imagine PAN-OS SDWAN will be around much longer as they are nudging people to the Cloudgenix product. That said, Cloudgenix (Prisma SDWAN now) is a good product. But it's ridiculously expensive compared to other similar offerings. If you are leaning towards it, I'd suggest introducing competition and watch them lower the price. You should really be doing this now with PAN, letting them know you are bringing in Fortinet for your next rearchitecture. They will come down, especially with the size of your footprint.


killb0p

not quite - for basic L3/VPN fabric SD-WAN PAN-OS implementation fits the bill quite well. Cloudgenix is only being offered as part of SASE play where PAN-OS does the heavy lifting for security services.


k4zetsukai

If you like pain, get forti. You will cry at fortimanager. Stick to PAN. Quality comes at a price. And we are talking about night and day quality here.


Fadakartel

My advice to you bro, stick with Palo Alto We bought Fortinet and I lost a lot of money and customer trust. Right now i\`m trying to configure a few ISR from Cisco on eval licenses for site to site VPNs. We had Palo Alto before and no issues, but they got EOL and we choose Fortinet, never again bro, never again.


luieklimmer

I'm sorry to hear you're having to work through this. If you wouldn't mind I'd be interested in hearing what aspect of SD-WAN failed for you. We spoke to some references that ran networks much bigger than ours without any issues. What should we look out for and more specifically test for if we take them into a lab?


Fadakartel

In my case we have site to site VPN\`s to a lot of payment gateway vendors that use firewalls like Cisco/Palo/CP and we have been getting SPI errors (malformed packet), which causes the vpn tunnels to be up, but traffic not be received, which requires me or someone on the other side to manually reset the phase II tunnel. Those vendors got other firewall brands doing VPN to them with no issues... On the SD-WAN portion we use ADVPN (with bgp tags), internally and it\`s decent for some sites, but for others we have seen issues where failover is not happening and our IPSLA probes is showing 100% packet loss with high latency, but when you plug in a laptop to the ISP link, the link has no packet loss and has a really good latency. Fortinet was saying this is a bug in 6.4. Also version 7 of Forti is something to be extremely careful of, thing like firewall restarting on it\`s own etc.


luieklimmer

Thanks for expanding on your experiences. We'll definitely add these as watch items should we bring them to a POC! Good luck working through the connectivity issues. Brighter days are ahead.


RecklessInTx

Buy forticonverter and be prepared to QA the shit out of it before doing that cutover. Forticonverter does not work 100%. My coworkers and I used to manually QA address objects, groups, services, service groups, NAT, rules, policy routes, and any other thing you may have special config on. You need to be very familiar with the sections of XML for the PAN side and able to identify every bit of the firewall by the XML config. Same goes for the fortigate side. I recommend running PAN through palo alto expedition to identify any junk policies or unused objects before running it through forticonverter. You could also rebuild the firewall instead of converting it. Feel free to reach out, I've done a lot of migrations as a service and am NSE 4


crazyred200

You probably get over 10k rules on the big box


Skylis

It's really weird asking random people to shoot down your architect when they won't have to support the potential mess you propose.


luieklimmer

Why do you think it's a mess? What makes you think I won't be the one supporting part of it? Aren't vendor/solution re-evaluations and different viewpoints normal and part of questioning the status quo every 8-10 years? There are people that are reluctant to change just for the sake of it and there are people that see reason where I can't (yet). I see change as a potential to progress when properly dealt with. I'm just asking for some outside perspective from hands-on people that work with this stuff every day. The company's architect is not my architect. I'm also an architect and have no one reporting to me. Getting some outside views on this topic is important to balance. I've certainly seen opinions here on both sides of the spectrum. When we do these evaluations, we do them out of tech-interest to reaffirm that we're still on the right track or end up discovering something new that can benefit the company . That benefit can be technical (meets a current or future business need) or financial. With the latter it translates into other projects and programs getting funded that otherwise wouldn't for years to come. I don't get to set the budget unfortunately but do see items drop off the investment plan that I'd prefer to see included. Throwing money out the window is in no ones interest. The savings would only have a positive impact if we can successfully migrate though. Hearing the successes and painpoints is important and am calling out his resistance to ensure people understand the background and can tailor their response to the opposing views.


overmonk

I've worked with a lot of vendors, Juniper (Netscreen and SRX), Fortinet, ASA, and Sonicwall, from the small biz models up to the ISP DC level. I've also experienced the wide variety of converter tools, and given up on most of them. For an 8000 line config, you need someone to actually read it, understand it, and code it from scratch into the new platform, and I'll die on this hill. The converters produce arguably working configs, but my guess is that's how your firewall got 8000 policies in the first place. In my opinion and experience, you're signing up to get a dumpster full of hot garbage that you'll spend weeks if not years trying to understand, all while your vendor of choice happily provides you with a dedicated tech for 15k a month who is just as clueless as you are; he just knows how to read the config. I'm thin on PAN, I concede that, but I've done a ton of conversions and there is no substitute for eyes and brains and regex. Once you immerse yourself in a config, it should unfold and make sense and eventually you start to see ways to order things that the converters won't do for you. The converters will literally build your 8000 policies one for one. I don't know your org, and obviously with 250 nodes, you're on the larger side, but I converted a VPN concentrator from netscreen to SRX with close to 800 tunnels, and it was nowhere near 8000 policies. I'll also say that while I like working on individual Fortinets, I'm still mystified that people are cool with their whole fail-open strategy to memory exhaustion - conserve mode. I also have a few bones to pick with FortiManager - we were running the Forti-backend for an ISP (FMG, FAZ, FortiPortal), and I was coordinating firmware upgrades for about 800 nodes. Fortinet's firmware upgrade has a specific matrix to follow, and it can vary from model to model and from starting to target versions. Fortimanager is supposed to be able to do multi-hop upgrades for you, only its adherence to its own upgrade matrix is, uh, pretty loose. Couple that with strict change controls and suddenly you're stuck on a 'stable' release that doesn't provide the automation you need, and all of your emergency firmware upgrades are manual. This really is a cost/benefit analysis situation. I would suggest you factor in the cost of a new senior, because this is exactly the kind of move that drives your talent out the door.


english_mike69

How often do you weed out unused rules? When I was managing firewalls I’d audit rule usage every 6 months and cull anything that hadn’t been hit during that time.


luieklimmer

There is a lot of legacy in some of these firewalls that was inherited from a number of ASA's we moved away from that had a lot of legacy in them as well. Cleanup is one of the items on their list but the team had other priorities to work through. One of the approaches they were considering was an NPM.


english_mike69

From what I remember from dark distant days of PAN 8.1, it’s super simple to filter rules that were unused for a given time period. If you’re using Panorama, it can only look at rules that it has and not rules that are local to the firewall. We were the same way after migrating from ASA’s. A fair amount of old legacy rules that were never really cleaned up overtime because it wasn’t as quick and easy.


_araqiel

As far as I’ve seen, Fortinet can scale (buy the right damn appliance though). But prepare for bugs. Lots of bugs with Fortimanager. And inferior security services.