Capex Freeze, Capex Ambitions: Consolidating a Multi-Site Fortinet Estate
Northwind Health Group runs 12 clinics and a 1,200-person head office. Its security stack grew by acquisition: 38 FortiGate 60F and 100F firewalls managed one box at a time, a single FortiAnalyzer appliance collecting logs, a third-party SIEM holding 18 months of investigation data, a separate NAC appliance covering 2,200 switch ports, and no sandbox or endpoint detection tool. The new CISO has a capex freeze for three quarters but an approved opex budget, and wants a credible single-vendor Security Fabric story before the FortiGate renewal in 90 days. The infrastructure team argues that FortiAnalyzer already is a SIEM, so FortiSIEM would be duplicate spend; the SOC team counters that they need correlation across firewall, endpoint and identity events plus case management. A reseller has proposed FortiFlex credits instead of outright appliance purchases, and FortiNAC for the 2,200 ports.
1. Explain how FortiManager, FortiAnalyzer and FortiSIEM would divide responsibilities in this estate, and settle the argument that FortiAnalyzer is already a SIEM.
Read the worked answer
Start by separating the three jobs, because the dispute is really about scope.
- FortiManager is the configuration plane for the 38 FortiGates: policy packages, provisioning templates, firmware and config backup, change audit and role-based administration. It does not analyse traffic or logs.
- FortiAnalyzer is the Fortinet log and analytics plane: log receipt and archiving, FortiView drill-downs, scheduled reports, and event handlers that can react to FortiGate, FortiEDR or FortiSandbox logs. It answers what the Fortinet devices saw and did.
- FortiSIEM is the correlation plane: multi-vendor collection, CMDB-driven event correlation, UEBA, case management and compliance reporting across sources that are not Fortinet.
The honest answer is that they overlap on Fortinet-only visibility. If the SOC only needs firewall dashboards and weekly reports, FortiAnalyzer is sufficient and FortiSIEM is duplicate spend. The decision test is two questions: does anyone still need to search the 18 months of third-party SIEM data during investigations, and does anyone actually work cases rather than read alerts? A yes to either points to FortiSIEM, with FortiAnalyzer retained as the Fortinet log store that feeds it. Also flag that correlation content needs tuning and staff skills, so budget professional services rather than assuming the tool self-configures.
2. Recommend an acquisition and licensing approach given the capex freeze, including what happens if FortiGuard or FortiCare entitlements lapse.
Read the worked answer
Separate the estate into stable and elastic demand, because they call for different funding models.
Thirty-eight branch firewalls serving fixed clinics are stable, long-lived demand. Perpetual hardware with multi-year FortiCare and FortiGuard subscriptions is usually the cheapest total cost over three to five years, and renewal is already 90 days away, so this is the natural moment to consolidate and negotiate. FortiFlex is credit-based consumption that can be converted into eligible product and service entitlements; it suits pilots, bursting, cloud instances and the opex-only constraint, but buying credits for a five-year steady-state branch fleet usually costs more than perpetual plus subscription. Confirm which SKUs are eligible in the current FortiFlex catalogue before promising the CISO anything.
Then explain the entitlement distinction clearly, because it drives a risk decision:
- FortiCare provides support, firmware access and hardware replacement. Without it, the estate runs unsupported firmware and cannot upgrade to fix vulnerabilities.
- FortiGuard provides the security services themselves: antivirus, IPS, application control, web filtering and the rest. Without it, signatures stop updating and detection quality decays from the day of expiry.
Recommendation: perpetual plus multi-year FortiCare and FortiGuard for the stable fleet, FortiFlex for the new FortiNAC, sandbox and any cloud components, and a written rule that internet-facing FortiGates never run with lapsed FortiGuard.
3. The CISO asks which products close the sandbox, endpoint and NAC gaps and how they integrate with what already exists. Outline the mapping and the integration points that create the Fabric story.
Read the worked answer
Map each gap to a product, then show the data flows, because the Fabric value is in the handoffs rather than in the SKU list.
- FortiSandbox covers file detonation. FortiGate policies can send suspicious files for inspection, FortiMail and FortiEDR can submit samples, and verdicts propagate back so the same file is blocked elsewhere. This is the missing layer for the office documents and archives the firewalls see.
- FortiEDR covers the 1,200 endpoints with prevention plus detection and response telemetry. It supplies process-level evidence that FortiAnalyzer and FortiSIEM otherwise lack, and it can isolate a host without waiting for a network rule change.
- FortiNAC covers the 2,200 switch ports: discovery, profiling, policy-based admission and quarantine. It pairs with FortiSwitch and FortiGate and can act on compromised-host signals.
Integration story to present: FortiManager deploys policy to all FortiGates, FortiAnalyzer collects from FortiGate, FortiEDR and FortiSandbox, and FortiSIEM correlates across them and the third-party sources. Be explicit that profiling and quarantine policy for 2,200 ports is a project, not a licence activation, and that misprofiled medical devices in a clinic environment are a clinical risk, so start in monitor-only mode.