A firewall you bought is not the same as a firewall you are protected by.
FortiGate next generation firewalls, SD-WAN and secure networks, supplied, configured, monitored and renewed by engineers who will still be reachable when the tunnel drops.
Engineering offices in Egypt, delivering on site across Egypt and Saudi Arabia, and supporting clients remotely across the Gulf, Africa, Europe and the United States.
Tell us how many users, how many sites and what has to stay up. The model follows from that.
What businesses call us about
Where firewalls stop protecting people
None of these show up as an outage. They show up on the day of the incident, or the day of the audit.
The subscription lapsed
A FortiGate without a current FortiGuard subscription is a router with a good reputation. Intrusion prevention, web filtering and antivirus stop receiving updates, and nobody is told.
The network was never segmented
One flat network where the reception PC, the finance server and the CCTV recorder all sit together. Once anything is compromised, everything is reachable. This is the single most common finding we write up.
The rules were never reviewed
Any-to-any rules added in a hurry three years ago and never removed. A firewall policy nobody has read is a firewall policy nobody can defend in an audit.
Nothing is logged anywhere useful
Logs held on the device, overwritten in days, with no retention. After an incident there is nothing to investigate with and nothing to hand a regulator.
Which FortiGate you actually need
Sizing is not about how many people you employ. It is about throughput once inspection is switched on, because that is the number that matters and the number vendors quote least.
Start with inspected throughput, not user count
A firewall rated for high raw throughput can fall to a fraction of it once SSL inspection and intrusion prevention are enabled. That lower number is your real capacity.
- Your internet bandwidth today, and what you expect in three years
- Whether SSL and TLS inspection is required by policy or by audit
- How many concurrent sessions, not just how many people
- Whether remote access VPN terminates here and for how many users
- What has to keep working if this box fails
We size on the inspected figure and say so in the quotation.
Single site, one office
The common case. One appliance, properly configured, with the subscriptions that make it a security device.
- FortiGate appliance sized to inspected throughput
- UTP or Enterprise subscription bundle, quoted for the full term
- Segmented internal networks by function, not by convenience
- Remote access VPN with multi-factor authentication
- Configuration backed up off the device, and restore tested
Best value comes from buying the right subscription bundle up front, not adding pieces later.
Multiple sites and SD-WAN
Where Fortinet earns its money. Branches joined securely, with failover that happens without a phone call.
- Secure SD-WAN across branches on mixed links
- Automatic failover between primary and backup circuits
- Application-aware steering, so voice and line-of-business traffic take the good path
- Central policy from FortiManager rather than device by device
- One consistent security posture at every site
This is normally cheaper than the private circuits it replaces.
High availability where downtime is not acceptable
For an operation that stops when the link stops, a single appliance is a single point of failure.
- Active-passive or active-active FortiGate pair
- Dual internet providers with automatic failover
- Failover tested and documented, not assumed
- Configuration synchronised between units
- Monitoring that alerts on a failover even when nobody noticed
We test the failover in front of you before we call the project finished.
Logging, reporting and evidence
The part that decides whether you can answer questions after an incident, or during an audit.
- FortiAnalyzer for central log retention and reporting
- Retention period set to match your policy and your regulator
- Scheduled reports that a manager can read, not only an engineer
- Evidence packs for ISO 27001, PCI DSS and insurer questionnaires
- Alerting into our monitoring so somebody sees it out of hours
Relevant now that Egypt’s Personal Data Protection Law is in force.
What a Fortinet engagement with Stark actually includes
Anyone can quote you a FortiGate. These are the parts that decide whether it protects anything.
Design and segmentation
Networks split by function so that servers, staff, guests, voice and cameras cannot reach each other by default. Written down, so the next engineer can follow it.
Deployment and cutover
Configuration built and tested before the change window, a documented cutover, and a rollback position. We do not configure production firewalls by trial and error.
Secure wired and wireless
FortiSwitch and FortiAP managed from the same console as the firewall, so a guest network is genuinely a guest network and not a route into finance.
Remote access that is not a back door
VPN with multi-factor authentication, per-group access rather than full network access, and a defined process for removing a leaver the same day.
Monitoring, patching and renewals
Firmware kept current on a planned schedule, subscriptions renewed before they lapse, and alerts that reach a person. Most expired FortiGuard licences we find were simply forgotten.
Policy review you can show an auditor
Periodic rule review with a written record of what was removed and why. This is the evidence auditors ask for and almost nobody has.
Network security running where downtime is expensive
Real Stark work. Client identifiers are withheld under confidentiality. Sector and scope only.
Segmented network and perimeter rebuild
Flat network separated into functional zones, next generation firewall deployed at the perimeter with intrusion prevention and inspection enabled, and central logging retained to policy.
Secure SD-WAN across sites
Branches connected over mixed links with automatic failover and application-aware steering, managed centrally so a policy change is made once rather than at every site.
Firewall estate evidenced for audit
Rule base reviewed and rationalised, logging and retention configured, and the whole estate documented as evidence for ISO 27001 and PCI DSS assessment.
References can be provided directly, on request and with the client’s agreement.
Three things we will tell you not to do
The questions we get asked most
Can you supply Fortinet hardware and licences in Egypt?
Yes. We supply, invoice locally in EGP with a proper Egyptian tax invoice, deliver, install and support. Renewals are tracked by us so a subscription does not lapse without anyone noticing.
We already have FortiGate firewalls. Will you take them over?
Yes, and that is a common engagement. We start with an assessment: firmware level, subscription status, rule base, segmentation and logging. You get that in writing before you commit to anything further.
How do you decide which model to quote?
From inspected throughput, concurrent sessions, VPN user count and what has to survive a failure. We show the reasoning in the quotation so you can check it rather than take it on trust.
Do you work with firewalls other than Fortinet?
Yes. We also work with Sophos and Cisco, and we will say when another vendor is the better fit. We would rather lose the hardware margin than install the wrong thing.
Can you support sites outside Egypt?
Yes. We deliver on site in Egypt and Saudi Arabia, and support clients remotely across the Gulf, Africa, Europe and the United States.
What happens after the installation?
It becomes part of your managed agreement: monitoring, firmware patching, rule review, subscription renewal and an agreed response time when something breaks.
Tell us what is at your perimeter. We will tell you what it is actually doing.
Model, firmware, subscription status and whether your network is segmented. That is usually enough to say whether you have a security problem or a purchasing one.
Sunday to Thursday, 9am to 6pm · Egypt, and remote support worldwide
Our other IT services
Every service below is delivered by the same team, under the same agreement.