Network Security
Network Security & Segmentation
FortiGate and Cisco-based network segmentation, firewall policy design, and access control.
Scope
- VLAN segmentation design across FortiGate and Cisco switching
- Firewall policy design (zone-based, least-privilege)
- Access control for wired and wireless network segments
- SD-WAN configuration for multi-site connectivity
Approach
- Mapped existing flat or loosely segmented networks before designing VLAN boundaries.
- Designed zone-based firewall policies around least-privilege access between segments.
- Rolled out segmentation in stages, validating each segment before moving to the next.
- Configured SD-WAN policies for site-to-site traffic where multiple locations were involved.
Context
A flat network means one compromised device can reach everything else on it. This project covered redesigning network segmentation around FortiGate firewalls and Cisco switching — separating traffic by function and trust level rather than leaving everything on the same broadcast domain.
What this involved
VLAN boundaries were designed around actual traffic patterns and trust levels: user workstations, servers, guest access, and IoT/peripheral devices each got their own segment. FortiGate firewall policies enforced least-privilege access between segments — a workstation VLAN, for example, has no business talking directly to a server VLAN’s management interfaces.
For sites with multiple locations, SD-WAN was configured to handle site-to-site traffic and failover without requiring a full redesign of the existing WAN links.
Approach
Segmentation changes were rolled out one VLAN at a time rather than all at once, with each stage validated against real traffic before moving to the next — a flat network that gets segmented overnight tends to break things that nobody mapped in advance.