- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
Firewall policies are the first and most consequential line of defence in any enterprise network. Yet across our engagements with Indian mid-market and large enterprises, PJ Networks consistently finds the same category of misconfigurations in FortiGate NGFW deployments — overly permissive outbound rules, unlogged internal east-west traffic, and management interfaces reachable from untrusted zones. These are not theoretical risks. They are the concrete footholds that attackers exploit in ransomware campaigns, data exfiltration events, and insider-threat incidents that we see in the field every quarter.
This guide distils the hardening steps our NOC/SOC team applies when onboarding a new FortiGate deployment, covering FortiOS 7.x best practices aligned to CERT-In advisories and India’s evolving DPDP Act obligations around data protection controls.
Fortinet’s FortiGate remains the dominant NGFW platform in Indian enterprise IT, running in financial services firms, manufacturing plants, healthcare networks, and government-adjacent entities. That market share makes it a high-value target for threat actors who actively reverse-engineer FortiOS firmware and publish exploitation toolkits targeting specific versions.
In 2024 and into 2025, multiple critical vulnerabilities in FortiOS — spanning SSL-VPN, the administrative interface, and deep packet inspection modules — were weaponised in the wild, with Indian organisations among those affected. CERT-In issued multiple advisories urging immediate patching and configuration review. Beyond patching, hardening the policy baseline is what prevents an exploited session from becoming a full-environment compromise.
The most common finding: a catch-all LAN → WAN: ALL services, ACCEPT, no logging rule left in place from initial deployment. This gives every endpoint in the network unrestricted internet access and produces no log telemetry. Attackers love this — they can beacon to command-and-control infrastructure, exfiltrate data, and download second-stage payloads with zero friction.
Remediation: Replace catch-all rules with application-aware policies. FortiGate’s Application Control and Web Filter profiles should whitelist required business SaaS destinations and block uncategorised or newly registered domains by default. Enable logging on every policy, including implicit deny.
FortiGate’s HTTPS management UI and SSH access should be bound to a dedicated out-of-band management interface or a tightly restricted management VLAN. We regularly find management accessible from the general LAN VLAN or, worse, reachable with an inbound rule from the internet. This dramatically reduces the attack surface if a zero-day targeting FortiOS’s administrative interface is published.
Remediation: Use config system interface → set allowaccess to restrict HTTPS/SSH to the management interface only. Configure config system admin with trusted host entries limiting access to known jump-host IP ranges. Enable two-factor authentication for all admin accounts.
Approximately 80 percent of enterprise web traffic is now HTTPS-encrypted. Without SSL deep inspection, your IPS, antivirus, and web filter profiles are effectively blind to the content of that traffic. Attackers increasingly deliver malware and exfiltrate data inside encrypted channels specifically because they know most firewalls skip inspection.
Remediation: Enable full SSL inspection on FortiGate using a CA certificate trusted by endpoints. Exempt financial and healthcare portals that pin certificates, but apply inspection universally to general web and cloud traffic. Pair with the IPS profile in blocking mode, not just monitor mode.
Network segmentation is only effective if inter-segment rules are narrow. We frequently find rules permitting broad port ranges (e.g., TCP 1–65535) between a DMZ and an internal server segment — usually a legacy rule that was never cleaned up. Each open port between segments is a lateral movement opportunity if an attacker compromises a DMZ host.
Remediation: Audit all inter-zone policies quarterly. For every rule, document the business justification. Use FortiGate’s Policy Hit Count feature to identify rules with zero hits over 90 days — candidates for immediate removal or tightening.
FortiGate stores logs locally in flash memory, which is limited in size and forensically unreliable — logs can be overwritten or destroyed if a device is compromised or rebooted. CERT-In’s 2022 directions require organisations to retain logs for a minimum of 180 days in India. Local storage on the firewall itself does not meet this requirement.
Remediation: Configure FortiGate’s syslog forwarding to a SIEM or dedicated log management platform. Ensure logs include traffic, event, UTM, and VPN sessions. We cover how PrahiX Ora handles this below.
India’s Digital Personal Data Protection Act 2023 and CERT-In’s 2022 Cyber Security Directions create binding obligations that directly touch firewall configuration. Specifically:
PJ Networks’ managed FortiGate service includes a quarterly policy review specifically structured around these compliance checkpoints — producing a report that can be shared with auditors and board-level risk committees.
Many Indian enterprises are running FortiGate in an SD-WAN configuration, using it to manage traffic across MPLS, broadband, and 4G/5G links simultaneously. SD-WAN adds another dimension to policy hardening:
FortiGate’s native SD-WAN integration with security policies is one of its significant advantages — but only when the policies are correctly configured and reviewed regularly.
One of the most persistent challenges for Indian enterprises running FortiGate across multiple sites is fragmented visibility. The branch firewall in Pune, the data centre FortiGate in Mumbai, the manufacturing-plant FortiGate in Nashik — each generates its own log stream, its own alert queue. Security teams end up context-switching between FortiGate management portals, missing the lateral movement that connects an anomaly on one segment to a campaign across three.
PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks is its primary field deployment and operations partner, and we run it on behalf of clients across their FortiGate estates. Here is what that looks like across Ora’s four core pillars:
SIEM — Centralised Log Ingestion and MITRE ATT&CK Correlation: Ora’s SIEM ingests FortiGate traffic, UTM, VPN, and event logs alongside endpoint, identity, and cloud-service telemetry. Correlation rules mapped to the MITRE ATT&CK framework surface attack storylines — not individual alerts — so our SOC analysts see the chain from an initial phishing email to a firewall policy hit to a lateral movement attempt, reconstructed as a single graph. Logs are retained in tiered storage (hot, cold, archive), supporting CERT-In’s 180-day in-country log retention direction without requiring clients to manage their own log infrastructure.
NMS — Unified Observability Across Firewalls, Switches, and WAN Links: For clients with fragmented multi-vendor estates — FortiGate firewalls alongside third-party switches or access points — Ora’s NMS provides unified observability using LLDP/CDP topology discovery and network path tracing. ML-based anomaly detection flags unusual traffic patterns (e.g., a FortiGate suddenly forwarding ten times its baseline volume to an external IP) and auto-healing policies can isolate the affected segment. This is particularly valuable for manufacturing and retail clients where the NOC team previously had to correlate separate tools to understand the network state.
Video Surveillance (VMS) — Physical and Network Security Under One View: Ora’s video surveillance (VMS) module manages ONVIF-compatible cameras alongside the network security estate — Hikvision and Dahua deployments included. For manufacturing, retail, and multi-site enterprises, this means physical-security alerts and network-security events can be correlated in a single operations view. A tailgating event at a server room door and an unusual authentication spike on the adjacent firewall become one investigation thread, not two.
SOAR — Playbook Automation for CERT-In’s 6-Hour Window: When a threat is confirmed, CERT-In’s 6-hour reporting window leaves very little room for manual processes. Ora’s SOAR module includes pre-built playbooks with automated response actions — including pushing updated blocklists directly to FortiGate. The moment a C2 IP is confirmed, the playbook pushes an IP reputation block to every FortiGate in the client’s estate simultaneously, then assembles the incident report structure needed for CERT-In notification. Automation is what makes a 6-hour window realistic; manual escalation chains are not.
If your organisation is managing multiple FortiGate deployments without a unified view of this kind, the gap in visibility is itself a security risk. Ask our team about deploying PrahiX Ora as the operations layer across your estate.
A hardened FortiGate policy baseline is not a one-time project — it is an ongoing operational discipline. Threat actors continuously probe for new vectors, FortiOS releases new features that require configuration review, and your own network changes (new applications, new segments, new sites) introduce policy drift.
PJ Networks’ managed FortiGate service covers:
If your organisation is running FortiGate without a structured hardening programme or 24/7 monitoring, you are likely carrying risk that would surprise your board. We offer a no-obligation firewall policy assessment for qualified Indian enterprises. Reach out to the PJ Networks team to schedule yours.
PJ Networks is an Indian managed security provider specialising in FortiGate/Fortinet deployments, 24/7 NOC/SOC operations, ZTNA, SD-WAN, MSSP services, and FortiMail — serving enterprise and mid-market clients across India. Learn more at pjnetworks.com.