International Rollout best Practices

[Holy]

Hello,

i am about to begin with a new project.

300D Cluster in HQ

7x 100D in Branches

30x 80D in Branches

the HQ is in Germany and the Branches all around the World. So now i want to do a good plan for this International Rollout.

i Think to do it this way,

prepare Templates for 100D and 80D on Manager > prepare Policy Packages for 100D and 80D > Prepare all the Appliances on the HQ with FortiManager > Test the Appliances > Ship the Appliances to Branches > They should connect automaticly to FortiManager (over Internet or IPsec ).

I Don´t think that i will need some Global Policys on FortiManager for that and i think i can to this with 1 ADOM because it is not too big Rollout.

What do you think? do someone have experince with international Rollouts with FortiManager? Any Tipps and best practices ? Warnings ?

What about connecting the Devices to FortiManager over Internet? is it not too risky? I mean i can secure the FortiAnalyzer logs using ipsec. But the Management Traffic would go over Internet, it will be HTTPS but still over Internet...

it is my first big Project and i would appreciate any Help.

Thank you.