Design concept and consideration

The NGFW deployment described in this guide was designed to be as extensible as possible. The deployment includes as few products as possible to keep the complexity relatively low. As a result, an administrator can enhance the configuration by adding to it rather than redesigning the configuration to fit their needs.

Additionally, several methods can be used to accomplish a given security requirement. Following is information about choices that were made with some alternatives for your consideration:

• Port selection for administrative access
• IP addressing scheme
• Physical topology
• VLAN segmentation
• Interface selection on FortiGate
• VLAN-aware managed level 2 switch (FortiSwitch)
• SSL/SSH inspection uses certificate inspection
• Administrative access HTTPS certificate
• WiFi networks