Zero-Trust Network Architecture with Fortigate

Zero-Trust with Fortigate NGFW

Zero-trust means: never trust, always verify. Every connection — even internal — must authenticate and be authorized explicitly.

Core Principles

1. Verify explicitly: Authenticate every user and device
2. Least privilege: Grant minimum required access
3. Assume breach: Segment networks; limit blast radius

Fortigate SSL Deep Inspection

config firewall ssl-ssh-profile
    edit "deep-inspection"
        set comment "Enterprise SSL inspection"
        config ssl
            set inspect-all deep-inspection
        end
        config https
            set ports 443
            set status deep-inspection
        end
    next
end

Application Control + IPS

config firewall policy
    edit 100
        set name "ZeroTrust-Outbound"
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "Corp-Users"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set ssl-ssh-profile "deep-inspection"
        set application-list "Enterprise-AppCtrl"
        set ips-sensor "Enterprise-IPS"
        set logtraffic all
    next
end

Micro-Segmentation with Security Zones

Create separate security zones for each network segment:

• ZONE-CORP: Corporate workstations
• ZONE-SERVER: Server farm
• ZONE-POS: Point of Sale devices
• ZONE-IOT: IoT and printer network
• ZONE-GUEST: Guest WiFi

Explicit deny rules between zones; only allow documented flows.

FortiAuthenticator + MFA

Integrate FortiAuthenticator for 2FA on all VPN and admin access:

config user radius
    edit "FortiAuth"
        set server 10.0.0.10
        set secret RadiusSecret
        set auth-type ms_chap_v2
    next
end

Continuous Monitoring

• Enable FortiAnalyzer log aggregation
• Set up threat dashboards per zone
• Alert on lateral movement patterns
• Weekly policy review cycle

Zero-trust is a journey, not a product. Start with segmentation, add MFA, and iterate.