Fortinet Partner · Egypt
The firewall is the easy part. Sizing it honestly is not.
Fortinet NGFW, SD-WAN and network access control, specified, installed, configured and then operated by the same engineers, from Cairo, Alexandria and Assiut.
Why buy Fortinet through Stark rather than a box shifter
Anyone can quote you a FortiGate. What decides whether it was a good purchase is what happens in the eighteen months afterwards: whether the rules were written properly, whether the licence renews at the right tier, and whether anyone picks up the phone when it drops at 3am.
Licensing sized to the requirement
We are not paid more for selling you the larger model. We have talked clients out of the bigger SKU more than once, and we will tell you when a FortiGate is not the right answer at all.
Escalation that goes somewhere
Partner status means that when the fault is genuinely Fortinet’s, we open the case as a partner rather than joining a public support queue behind everyone else.
The people who install it, run it
No handover to a support desk that has never seen your environment. The engineer who configured the policy is the one who answers when it breaks.
Where we have deployed it
Across our data centre, payment and campus programmes, the security layer is built on Fortinet: firewall, WAF, NAC, SD-WAN and UTM. The switching underneath it is usually Cisco. That split is deliberate: each vendor doing what it is strongest at, with one team accountable for both.
| Programme | What the security layer had to do |
|---|
National Data Centre
Government & defence · Egypt | Firewalls, SD-WAN, network access control and segmentation across a complete data centre build, delivered under strict security and confidentiality requirements. |
National E-Payment Platform
Fintech · Egypt · 24/7 SOC | Network core and SD-WAN connectivity, with WAF and NAC protection on the stack behind a national payment service, monitored around the clock. |
Secure Compute Cluster
Licensed e-payment provider · Tier-III DC | Core routing, switching, firewalls and SD-WAN with payment-grade controls: WAF, NAC, privileged access management and continuous vulnerability management. |
Contact-Centre Campus Network
Global hotel group · Egypt site | A Fortinet firewall pair in active-passive HA as the security boundary for a contact-centre floor, designed so no single link, switch or firewall can take the floor offline. |
These are real Stark programmes. Client identifiers are withheld under confidentiality.
What we deliver on Fortinet
NGFWNext-generation firewall sizing, deployment, policy design, HA pairs and hardening.
SD-WANMulti-site connectivity, link steering and failover for branches that cannot afford an outage.
Network access controlWho and what is allowed onto the network, and what happens to everything else.
Secure accessRemote and site-to-site access built to be used, not worked around.
Licensing & renewalsCorrect tier, tracked ahead of expiry, renewed before it lapses rather than after.
What we actually configure on a FortiGate, and what sits around it
A firewall out of the box blocks very little. Almost every FortiGate we are asked to assess is running with deep inspection disabled, a default IPS profile, and half of the features it is already licensed for never switched on. This is the work that turns the appliance you bought into the security control you thought you were buying.
On the firewall itself
Policy by identity, not by IPFirewall policies bound to users and groups from Active Directory or Entra ID through FSSO, so a rule follows the person rather than the desk they happen to be sitting at. It also makes the logs readable, a name, not an address.
SSL/TLS deep inspectionThe overwhelming majority of traffic, and of malware delivery. Is encrypted. Without deep inspection the antivirus, IPS and web filter are inspecting an envelope they cannot open. We deploy the inspection certificate to the estate and maintain a deliberate exemption list for banking, health and payroll traffic.
IPS and virtual patchingIntrusion prevention tuned to the services you actually publish, blocking exploitation of a known CVE at the boundary while the real patch is scheduled properly. This is what buys you time between a vendor advisory and a maintenance window.
Antivirus and inline blockingFlow and proxy-based scanning on the paths that matter, with unknown files held for verdict rather than passed through and regretted later.
Web and DNS filteringCategory filtering, newly-registered-domain blocking and DNS-layer enforcement so a phishing link fails before the browser ever renders it.
Application controlVisibility of what is genuinely running across the link, the unsanctioned file-sharing tool, the remote-access utility nobody approved, the personal cloud drive syncing company data out.
SegmentationVLANs, zones and internal firewall policies, and VDOMs where one appliance has to serve separate administrative domains. Segmentation is what decides whether one infected laptop becomes one incident or an estate-wide one.
High availabilityActive-passive or active-active HA pairs with session pickup, tested by actually failing the unit over during commissioning rather than trusting the configuration screen.
Getting the right people on, and keeping everything else off
Universal ZTNAPer-application access with a device posture check on every session, instead of a broad VPN tunnel that drops an unmanaged laptop straight onto the LAN. The FortiGate is the proxy; FortiClient EMS supplies the posture tags.
FortiClient and EMSCentral control of the endpoint agent: compliance rules, telemetry back to the Fabric, and the ability to say honestly which machines are actually protected rather than which ones were imaged that way.
FortiAuthenticator and FortiTokenMulti-factor on the VPN and on administrative access, RADIUS for network authentication, and certificate services where 802.1X requires them. Administrator access to the firewall without MFA is the single most common finding in our assessments.
FortiNACProfiling of every device that appears on the network, 802.1X enforcement, and a quarantine VLAN for anything unrecognised. This is the only practical control for printers, cameras, door controllers and building systems that will never run an agent.
FortiSwitch and FortiAPSwitching and wireless adopted by the FortiGate over FortiLink and managed from the same console, so a policy written once applies at the port and at the SSID, not three separate configurations that drift apart within a year.
Secure SD-WAN and SASE
Application-aware link steeringSLA probes measure latency, jitter and loss per link continuously, and traffic moves before users notice. Voice and payment traffic get the healthy path; backup and updates take what is left.
Failover that has been provenWe fail the primary circuit during commissioning and watch what actually happens to a live call and a live session. A failover that has never been tested is a plan, not a control.
FortiSASE for people off the networkThe same web filtering, application control and inspection applied to staff working from home or travelling, without hairpinning every session back through head office.
Beyond the network: mail, published applications and endpoints
FortiMailAnti-spam, anti-phishing, impersonation and business-email-compromise detection, attachment sandboxing and outbound control. Either in front of an on-premises mail server or alongside Microsoft 365.
FortiWebA web application firewall for anything you publish: OWASP Top 10 protection, bot mitigation, API security and rate limiting. A NGFW policy that permits 443 to a web server is not protection of the application behind it.
FortiEDRDetection and response on the endpoint, with blocking at the moment of execution rather than after the file has been written and the damage done.
FortiSandboxDetonation of unknown files in isolation, with the verdict shared back across the Fabric so every other device learns from one detection.
Running it at scale, and knowing what it found
| Platform | What it is for | When you actually need it |
|---|
| FortiManager | Central configuration, policy packages, staged change and rollback across many firewalls. | From roughly five FortiGates upward, or anywhere a change has to be identical across sites. |
| FortiAnalyzer | Log retention, correlation and reporting across the Fabric. Including the compliance and audit reports somebody will eventually ask you for. | Almost always. A firewall that keeps its logs only in local memory cannot answer any question after a reboot. |
| FortiSIEM | Multi-vendor event correlation across the whole estate, not only Fortinet devices. | When there is a security team, or a service like ours. Genuinely watching it. Not before. |
We build and operate all three for clients. We will also tell you plainly when you do not need the third one yet.
Where we draw the line. The Fabric is only worth what someone does with its output. We would far rather switch on the inspection, IPS profiles and logging you have already paid for than quote you the next SKU up, and in most assessments that is precisely what we recommend. Buying FortiSIEM and leaving the console unread is a more expensive way to be breached.
Where Fortinet is not the answer
Sometimes it isn’t. If the requirement is a single security console across firewall and endpoint, Sophos may fit better. If the network layer is already standardised on Cisco, mixing vendors at the boundary can cost you more in operational friction than it saves on the purchase order.
We run mixed estates and we will tell you which way to go before you commit. That conversation is free.
Free firewall assessment, no obligation
Tell us how many users and sites you have and what you are protecting. We will come back with an honest sizing, what it costs, and whether you need it at all.
Book the free assessment02 35375791
