This document discusses trends in secure wireless access and Fortinet's secure access architecture. It notes that more devices are connecting to networks wirelessly, requiring higher speeds and a seamless user experience. Wireless access is now the weakest security link. Fortinet offers secure access solutions that combine security, wireless LAN management, and switching infrastructure. These include infrastructure, integrated, and cloud-based wireless options to fit any environment from distributed enterprises to large public venues.

1. © Copyright Fortinet Inc. All rights reserved.
Secure Access Architecture
Alessandro Berta – Systems Engineer
15 Aprile 2016

2. 2
Trend: Device Growth Continues
More devices and newer device types are entering the network
 33 Billion endpoints projected to
be connected by 2020 – Gartner
 New device types entering the
network
» ‘headless’ IoT, wireless sensor
nodes, beacons, wearables

3. 3
Trend: Devices Going Wireless
Wi-Fi becoming the primary access medium
© Nemertes Research, August 2015
9%
7%
13%
35%
36%
0% 10% 20% 30% 40% 50%
Other
ZigBee
Bluetooth
Wi-Fi
Ethernet
Percent of Respondents
LANAccessTechnologies
2014
• Each generation of Wi-Fi technology accelerates the migration
to wireless for users
IoT Access Technology Predications
© Infonetics, M2M Strategies by Vertical: N. American Enterprise Survey, January 2014
64%
Wireless
• IoT devices going wireless

4. 4
Trend: Need for More Speed
Migration to 802.11ac continues
1st Generation
1997-1998
2nd Generation
1999-2001
3rd Generation
2002-2006
4th Generation
2007-2011
5th Generation
Now
802.11
2 Mbps
802.11b
11 Mbps
802.11g/a
54 Mbps
802.11n
450 Mbps
802.11ac
Gigabit Mbps
Infonetics, Wireless LAN Equipment Quarterly Worldwide and Regional Market Share: 4Q14
Migration to 802.11acWi-Fi Standards Evolution

5. 5
Trend: Seamless User Experience
A unified access experience is the expected norm
 Users utilize multiple devices in the enterprise
» Wireless: smartphone, tablets
» Wired: desktops, workstations
 Consistent user experience is the norm
» Consistent policies for access, application, security
 Seamless device experience
» New device types must be provisioned appropriately
» “Headless” devices – IoT
Access
Points
Switch
Wireless Wired
Authentication

6. 6
Wireless - the Weakest Link
Endpoint
Core network
infrastructure
Wireless Databases Applications Storage Email
Worldwide 45% 29% 49% 25% 17% 11% 25%
Americas 43% 28% 50% 27% 17% 12% 23%
EMEA 47% 27% 52% 22% 17% 10% 24%
APAC 43% 31% 44% 25% 18% 10% 29%
0%
10%
20%
30%
40%
50%
60%
WLAN Ranked as the Most Vulnerable IT infrastructure
Source: Fortinet Security Census 2015, 1490 respondents

7. 7
Expectations are on the Rise
Need More Speed
Migration to 802.11ac
Seamless
Unified Experience
Unified Network
Operations
Application Growth
Move to wireless
Device Growth

8. 8
Combine Security and Access
Need More Speed
Migration to 802.11ac
Seamless
Unified Experience
Unified Network
Operations
Application Growth
Move to wireless
Device Growth
SECURE ACCESS
ARCHITECTURE

9. 9
FortiPresence FortiAuthenticator
FortiManager FortiWLM
FortiClient FortiWiFi
FortiWLC
FortiAP
FortiGate Controller
FortiSwitch (POE)
SECURE ACCESS
ARCHITECTURE
N
Why Fortinet?

10. 10
Complete Secure Access Offerings
Note: formally Meru Networks
Cloud
APSwitch
Cloud
(Cloud Management)
Security
+
WLAN Management
APSwitch
Integrated
(Integrated Controller)
AP
Security
WLAN
Management
Switch
Infrastructure
(Dedicated Controller)
1 2 3

11. 11
Fortinet Offers More Choices
Infrastructure
(Dedicated Controller)
Integrated
(Integrated Controller)
Cloud
(Cloud Management)
Distributed Enterprise
(Retail / QSR)  
Healthcare / Financials  
K-12 / Primary / Secondary
School  
Higher Education 
Large Public Venue 

12. Infrastructure Wireless
Secure Access Architecture

13. 13
Why Infrastructure?
1
 Mobile: Fit for highly mobile deployments
 Flexible: Many deployment options
 Stand-alone: Able to separate access purchase decision from security
FortiWLC-50D
FortiWLC-200D
FortiWLC-500D
Infrastructure Wireless

14. 14
Infrastructure Wireless
Multi-Channel
One channel to simplify deployment
and seamless roaming
Multiple channels to maximize
spectrum reuse and performance
Single Channel + Virtual Cell
36 36 36
36 36 36 36
36 36 36
Multiple channels to segment
application traffic and add capacity
Channel Layers + Virtual Cells
36 36 36
36 36 36 36
58 58 5844 44 44
44 44 44 44
42 42 42
149 149 149
149 149 149 149
149 149 149
1

15. 15
Infrastructure Wireless
Network In Control
Fortinet decides when clients roam for best
possible user experience in time-sensitive
applications.
Mobile
Fit for highly mobile and scalable deployments
where low latency and roaming support matter
Controlling the User Experience
1

16. 16
Client-in-control: the “Sticky Clients” issue
Scanners and VoIP handsets re-charging in the cradles
1

17. 17
Client-in-control: the “Sticky Clients” issue
WiFi Client tend to stick to the same AP, depending on their NIC driver
1

18. 18
Client-in-control: the “Sticky Clients” issue
The AP-Client links are barely optimized. Many connections are at long distance, weak
signal, low data rate, scarce throughput.
1

19. 19
Network-in-control
Optimized Distribution of Clients
Wi-Fi Clients are always associated to the best AP: higher signal, faster data rate, better
performance, AP’s are not congested by far-away clients.
1

20. 20
Roaming is really Seamless and at the right time
20
X
Multi-Channel
Virtual Cell
100 ms – 3 seconds
between handoff 5 - 10 ms
between handoff
X
1

21. Integrated Wireless
Secure Access Architecture

22. 22
Integrated Wireless
Security Access
Control
 Enterprise WLAN controller
 Rogue AP and WIDS
 Integrated captive portal
 Tunnel, bridge and mesh
 Single pane of glass
 Unified wired/wireless
 Application control
 FortiGuard Services
Security
2

23. 23
Integrated Wireless
 Every FortiGate includes a WLAN controller
 Largest range of controllers in the industry
 Support ranges from 5 APs (100 users) up to 10K APs
(32,000 users)
2

24. WiFi > SSID2

25. FortiView > Device topology (SSID and VLAN)2

26. FortiView > Applications2

27. FortiView > Applications > Drill Down > Sessions2

28. FortiView > Threat Map2

29. Cloud Wireless
Secure Access Architecture

30. 30
Why Cloud?
3
FAP-S323C
802.11ac
3x3:3
FAP-S321C
802.11ac
3x3:3
 Secure: Industry’s only UTM + AP solution
 Cloud: Roll out remote sites in minutes - not hours and days
 Controller-less: Wi-Fi without the complexity of on premise controllers
Cloud Wireless

31. 31
Competitor Cloud Wi-Fi FortiAP-S Series
Connection
Credential Lookup
Authentication
Gap in Security
Protection
Continue to Wire
Connection
Credential Lookup
Authentication
IPS, AV, Botnet
URL Filter, App Control
Continue to Wire
 Managed by FortiCloud
 No controller required
 FortiGuard services run on each AP
 Simplifies deployment and management
Cloud Wireless3

32. 32
Cloud Wireless
Intrusion Prevention System
Antivirus and Anti-botnet
L7 Application Control
Web Filtering
3

33. Other Secure Access related products
Secure Access Architecture

34. 34
FortiPlanner
 Wireless LAN Planning and Real-Time Visualization Software
 Free download for deployments of up to 30 FortiAPs.
 Pro license supports unlimited FortiAPs and enables Site Survey and Real-Time
Heat-map features
FortiPlanner wireless deployment planning FortiPlanner wireless site survey

35. 35
FortiPresence
Presence Analytics Solution
Uses existing in-store FortiAP or FortiWiFi access points to collect the WiFi signal information from the
smartphones of visitors.
 Solution Components:
» FortiAP or FortiWiFi - Detects WiFi signal from smartphones
» FortiGate or FortiWLC - Aggregates signal information from multiple APs
» FortiPresence Cloud – Processes data and presents analytics on dashboard
FortiPresence

36. 36
FortiPresence
 Total visitor traffic
 Real time visit capture rate
 Dwell time duration
 A/B comparison across stores
 Repeat visitors, frequency
 VIP Alert
 Heat maps with animated flows
 Real-time density, staff resources
 Measure marketing campaign effectiveness

37. 37
FortiSwitch
Why FortiSwitch?  Control: Managed and secured from FortiGate GUI
 Power: Full PoE+ power for APs and other Power over Ethernet devices
 Stackable: 1GbE, 10GbE and 40GbE with stacking capability

38. 38
FortiGate Switch Management
» Fortilink protocol for secure
management
» Visibility into port speed/status
» Centrally manage VLANs
» Apply security policy
» Authenticate clients centrally via
802.1x or captive portal
FortiSwitch

39. 39
FortiPresence FortiAuthenticator
FortiManager FortiWLM
FortiClient FortiWiFi
FortiWLC
FortiAP
FortiGate Controller
FortiSwitch (POE)
SECURE ACCESS
ARCHITECTURE
N