IT‑IS‑Networking
Equipment › Network & Security Hardware

Fortinet

Inline intrusion prevention at an enterprise core for a decade — and the bypass appliance that made running it inline survivable.

Product lines and other names: FortiGate, FortiBridge, FortiSwitch, FortiNAC, VDOM

Left to right is time. Each row is one of the 15 disciplines Fortinet carried, ordered so kindred disciplines sit next to each other rather than alphabetically — a landscape only means anything if neighboring rows belong together. Height is the work running in that domain in that year, weighted by what failure would have cost — life-safety ×3, a statutory obligation ×2.2, the estate itself ×1.5, an evaluation ×1. Every project declares which of those it was, so each ridge traces to an entry you can open and disagree with. Only the work that named this manufacturer is counted, so this is the shape of what it carried rather than of the record around it. Height and color are on the record-wide scale rather than this page’s own, so a modest estate draws a modest landscape and any two of these pages can be read against each other.

FortiGate with VDOM separation across the estate: 3200D as the core pair, with 3400, 2600F, 1000D, 600D (FIPS 140-2), 501E on the dispatch path, 500D, 200D and 100D elsewhere. FortiSwitch added in 2023.

The part worth keeping is FortiBridge. Inline inspection at a core means the IPS becomes a single point of failure for everything behind it. Fortinet’s own July 2016 option list put it plainly: one-armed as detection only; inline with a single unit behind FortiBridge for fail-open, optical failover and heartbeat detection; or inline as an HA pair. Option two is what was built — enforcement at the core without the enforcement becoming the outage.

FortiBridge 2002 and 2002F bypass units were evaluated in November 2016 and installed that December specifically to make the IPS installation possible. In August 2020 they were deliberately moved off pure fail-open to fail-close on link failure — an availability-versus-security decision taken on purpose rather than left at a default.

Where it appears

Declared on each entry rather than listed here, so this page cannot drift from the work it describes. What each entry named is quoted as it stands, with how much of that project rested on it and what stands behind the claim beside it. The first of those drives the height of the surface above.

NRI North America (formerly Core BTS)

City of Jacksonville