- CARE USA implemented Fortinet network security appliances across its offices globally to simplify and centralize its previously convoluted and localized ICT systems. - The Fortinet appliances provide capabilities such as network segmentation, centralized threat management, application control and web filtering to improve security. They also enable remote management, dynamic reporting and VPN access. - The solution deployed Fortigate appliances tailored to office sizes, with models for medium/enterprise and small offices. This provided standardized setups for firewall policies, QoS, UTM security services and WIFI access across CARE USA's network.

1. Fortinet Network Security Appliance
CASE STUDY OF CARE USA

2. Introduction
CARE USA has a presence
in over 50 countries across
LAC,MENA,WA,ECSA

3. NOW LATER
Convoluted system design Simple system design
Undocumented ICT capabilities Repeatable capabilities
Localized ICT leadership and support Centralized ICT leadership
Localized ICT governance Centralized ICT governance

4. ICT challenges on the ground

5. The plan…

6. Alpha Office- (35+ users)
Fortinet
Fortigate
200E
ASA
Firewall
5525
Edge
Router 2911
0/0 WAN1
0/1
0/9
0/2
EDGE
0/1
0/24
SW-13
0/3
Internet
0/20
0/0
0/1 0/4
0/8
0/11
0/8
0/12
0/7
0/19-20
0/19
slave 2-sw4
slave 1-sw3
Master-sw2
0/19-20
0/3-15
0/9-10
0/16-17
0/21-22
0/16-17
0/21-22
0/21-22
0/1-3
0/1-2
sw5
IDF
0/230/24
0/2-18
0/19-20
0/21-23
0/1
0/1-15
Edge
Switch
3750

7. Small Office (9-35 users)
Fortinet
Fortigate
100D
WAN1
0/2
VSAT
MODEM
SW-13
Internet
0/24
0/19
Master -sw1
0/3-15
0/9-10
0/22-23
Slave -sw2

8. Why fortinet?
• Intelligent network segmentation
• Centralized administration and threat
management
• Flexible WIFI deployment options

9. Ctd..
• Current day security defense and detention.
• Multi-browser compatible dash-boarding.
• Dynamic reporting and drill down in connections settings.
• Multifunctional device with a small footprint.
• Enhanced Bandwidth/QOS traffic prioritization and shaping services for offices
with Internet speed issues.
• Dynamic & detailed reporting information:- on bandwidth usage, security events,
and system changes

10. Solution Adapted
• Medium to Enterprise Solution
• Basic security monitor and lockdown
• Application control and throttling
• Web filtering and control
• VPN/SSL service for both Medium to Large Enterprise
• Report capture on source and destination
• Subscription base UTM updates giving the most current security updates

11. Introduction - Dashboard

12. QOS
• Available to both network or application category to provide control of
network saturated offices.
• Priority to business critical services e.g. email,
skype for business, financial management app
• Load balancing with VIP’s

13. UTM’s

14. VDOM’s
Standardized setup to provide the following support structure on the system:-
• Care-SSL = Will be configured as a primary SSLVPN network for making
resources available to supported users.
• CARE-UTM = This is a L2 network pass through for allowing wired country
offices application control and filtering of security breaches.
• Root = Default environment used as a control point.

15. WIFI
• Multiband wifi solution 2.4GHz and 5GHz comes with the system ability to
scale with the network environment.
• All FortiGate come with the ability to be a wireless controller
• The option of network bridging or tunneling can be deployed to
accommodate small to large Enterprise network.

16. Firewall Policies
• Deploy filters
• Manage the types
of devices connecting
on the network
• Manage what each
device has access to

17. Monitoring
• Traffic logs
• Generate reports

18. Troubleshooting
• ICMP tests
• Ping/clone a ping from a
different end-point
• Tracert
• Traffic Logs

19. Licensing
• Bundled annual subscription ($33k) service managed from FortiManager and
enables CARE to
• Upgrade IOS
• Manage patches – IPS/AV
• Monitor remotely
• Forti UTM bundle with every equipment purchase

20. Challenges/Overcoming them
• Remote deployment
• Adaptation in CO’s
• Equipment purchase from HQ in US
To overcome these:-
• Continuous research to customize solution
• Training sessions national local IT leads/team
• Identify local vendor

21. What has worked well
• WIFI deployment
• UTM through VDOM’s
• Software VLAN’s
• Second layer of security with IPS and AV
• Bandwidth throttling with traffic shaping

22. We are now able to
• Enforce firewall policies
• Implement QOS; traffic shaping
• Intelligent reporting
• Enforce WIFI segmentation

23. Q&A