UTM Features

Hi Lea, Firstly, I would avoid the 30E completely. It doesn’t have enough memory for even a small number of users and will not support the 6.6 and 7.0 firmware releases. The 40F is a far better product and similarly price. Likewise I would stick to the 60F rather than the 60E (which are almost identically priced). The FortiAPs from the F series (231F etc) are pretty good too- and are managed and controlled from the Fortigate. I wouldn’t use the Fortigates with WiFi- the WiFi tends to be a little limited. Check carefully before you go for them. Likewise the FortiSwitches are controlled and managed from the Fortigate. The “single pane of glass” view for the FortiAPs and FortiSwitches is very useful and helpful. The documentation site is pretty good these days. You can find it here (if you hadn’t already):- [link]https://docs.fortinet.com/[/link] Some specific comments:- - IPS has options to block malicious web sites and connections to Botnet C&C servers. I would suggest it is essential for all traffic to/ from the internet. - Webfilter is very useful. You block by category and should restrict categories like “potentially liable”, “security risk” etc. Again I would apply to all traffic facing the internet. - App control is worth using. It does let you see apps being used- and again there may be some you want to block. For example some remote control apps etc. For app control to fully work ssl deep inspection is required. That can be tricky- effectively the Fortigate performs a “man in the middle” inspection so the Fortigate’s CA cert needs to be trusted by the device. Not always easy to do or get right. - Antivirus is useful and will scan all traffic. Again it can’t see a virus in an SSL/ HTTPS connection with deep inspection. But never the less well worth having. - Anti-spam doesn’t sound like it is needed in your scenario. - Industrial database is more aimed at operation technologies I think. Things like PLCs used in a factory, SCADA networks things like that. - Security rating is helpful- it does steer you towards good security practices. You haven’t mentioned DNS filter- again for me this is essential. Each DNS query is validated against a database and a a block ip is returned for blocked categories. I have used DreyTek devices a few times and they are decent routers. But the Fortigates are much more capable, faster and secure- when properly configured. The custom FortiNet network and content processors (or SOC chips for the models you are looking at) are very good. If you are managing a number of small businesses it might be worth looking at FortiManager (for easy and consistency of deployment) and FortiAnalyzer for detailed reporting and logging. Obviously those choices will depend on budgets and what service levels you are providing. Hope that helps a bit. Kind Regards, Andy.