- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
Indian enterprises face mounting pressure to modernise their network perimeter. The DPDP Act’s data-protection mandates, CERT-In’s tightened incident-reporting norms, and a threat landscape in which sophisticated adversaries specifically target South Asian critical infrastructure all converge on a single conclusion: “upgrade when convenient” is no longer a viable posture. The firewall—your first and most consequential enforcement boundary—must be right-sized, correctly configured, and actively managed.
This post distils what PJ Networks has learned from deploying and operating FortiGate next-generation firewalls (NGFWs) across banking, manufacturing, logistics, and healthcare clients in India. Whether you are refreshing legacy hardware, consolidating a multi-vendor estate, or preparing for a DPDP or ISO 27001 audit, the patterns below will save months of trial and error.
FortiGate is not the only enterprise NGFW, but it is the one PJ Networks recommends most often for Indian deployments—not because of vendor relationships, but for three practical reasons.
Undersized firewalls are the single most common problem PJ Networks inherits when taking over managed security from a client’s previous vendor. The appliance that looked adequate on paper was sized against raw throughput—ignoring the steep penalty that activates the moment you turn on deep packet inspection, SSL inspection, and IPS signatures simultaneously.
A firewall that ships from the box is not a secure firewall. These are the FortiOS configuration areas where PJ Networks NOC engineers most often find gaps during onboarding audits.
Many organisations enable “certificate inspection” (SNI-only) instead of “full SSL inspection.” Certificate inspection catches SNI-based filtering but does not decrypt payload—malware delivered over HTTPS passes straight through. Full SSL inspection with a trusted CA certificate deployed to endpoints is the correct posture for any environment handling personal data under DPDP or financial data under RBI guidelines.
Default IPS profiles are broad but not tuned for your environment. For Indian manufacturing clients, PJ Networks almost always adds signatures for industrial protocol anomalies and disables signature categories that generate noise without detection value. Application control policies should block known command-and-control categories explicitly—not only rely on IPS to catch downstream traffic.
On-box logging fills disk, slows the FortiGate, and is destroyed if the appliance is compromised or replaced. All log streams—traffic, threat, event, VPN—should forward to an external SIEM. Under CERT-In’s directive, logs must be retained for 180 days on Indian infrastructure. If you are using FortiAnalyzer, ensure its storage and archive policy reflects that requirement. If you are using a third-party SIEM (see the PrahiX Ora section below), confirm the ingestion connector and retention tier are configured correctly before go-live.
FortiOS vulnerabilities have been actively exploited against Indian organisations. A structured patch cadence is not optional. PJ Networks operates a maintenance window programme for managed clients: critical patches within 72 hours of Fortinet PSIRT advisories, feature releases after a two-week staging-environment soak period.
FortiGate 7.x introduced inline ZTNA, allowing the firewall to act as the access proxy—enforcing posture checks and identity verification for every application session, not just at VPN connect time. For Indian enterprises running hybrid workforces, this is architecturally significant: an employee in Chennai connecting to an ERP application in Mumbai is subjected to continuous verification, not a one-time VPN authentication that persists for hours.
For ZTNA to deliver its full value, FortiGate must integrate with a reliable identity provider (FortiAuthenticator, Azure AD, or Okta are most common in our deployments) and an endpoint posture agent (FortiClient EMS). The posture check should enforce minimum OS patch level, enabled disk encryption, and absence of known malware before granting application access.
FortiGate SD-WAN is embedded in FortiOS—there is no separate overlay appliance to manage. For Indian branch offices, the typical topology PJ Networks deploys is an active broadband or MPLS primary, plus an LTE or second-ISP failover, with SD-WAN health checks driving automatic failover within seconds.
Application steering policies route latency-sensitive traffic—Microsoft Teams, Citrix, VoIP—via the lowest-jitter path; bulk backup and less-critical traffic use the less-expensive link. FortiGate can identify thousands of application signatures, including Indian SaaS applications such as Zoho, TallyPrime, and ClearTax ERP. Where a new application is not yet in the Fortinet database, custom application signatures can be written and pushed to all FortiGates via FortiManager in minutes—an important capability for operations teams managing 20+ branches.
A correctly deployed FortiGate generates rich telemetry—firewall events, threat detections, VPN sessions, SD-WAN path metrics, DNS queries, and more. The challenge is making that telemetry actionable across a multi-site estate without drowning your security team in noise. This is the problem the platform we deploy and operate for clients—PrahiX Ora—was built to solve.
PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks is its primary field deployment and operations partner.
SIEM. Ora ingests FortiGate syslog, FortiAnalyzer-forwarded events, endpoint telemetry, and cloud audit trails into a single correlated event store. Correlation rules are mapped to MITRE ATT&CK, so analysts see not just an alert but a tactical technique—T1059 (scripting), T1078 (valid accounts), T1190 (exploit public-facing application)—and a graph-based attack storyline that shows lateral movement visually. Tiered retention (hot, cold, archive) is configured to satisfy CERT-In’s 180-day in-country log retention direction without runaway storage costs. This is particularly relevant for financial and healthcare organisations being asked to demonstrate compliance with CERT-In’s sectoral directives.
NMS (Network Management System). Beyond security events, Ora provides unified observability across FortiGate firewalls, FortiSwitch stacks, FortiAP wireless, WAN links, and third-party network devices. LLDP/CDP topology discovery builds a live network map automatically; network path tracing and ML-based anomaly detection flag link degradation before it becomes an outage. For clients with fragmented NOC visibility across a multi-vendor estate—FortiGate at HQ, Cisco switches at branches, Ruckus APs at plants—a single pane of glass for both NOC and SOC reduces mean time to detect and mean time to respond measurably.
Video surveillance (VMS). Ora’s video surveillance module manages ONVIF-compatible cameras—including Hikvision and Dahua installations common in Indian manufacturing and retail sites—with video analytics for motion detection, perimeter intrusion, and crowd density monitoring. Critically, physical security events appear in the same incident queue as network security events. A forced door event in a server room and a concurrent anomalous login from the same building become one correlated incident, not two separate alerts in two separate systems. For multi-site manufacturing and retail estates, this single operations view is a meaningful operational advance.
SOAR (Security Orchestration, Automation, and Response). When CERT-In’s 6-hour incident reporting window is a real compliance obligation, manual playbooks are not fast enough. Ora’s SOAR module ships with pre-built connectors and automated response actions, including pushing blocklists and dynamic address groups directly to FortiGate. A confirmed phishing campaign identified at 11 PM triggers an automated response: IoC ingestion, firewall policy update, affected endpoint isolation, and a draft CERT-In report populated from the incident timeline—all before an analyst wakes up. The 6-hour window becomes achievable rather than heroic.
If your FortiGate estate is growing and your NOC and SOC teams are looking at different screens for correlated problems, PrahiX Ora is worth a conversation. Contact PJ Networks to see a live deployment.
Indian data centres often have asymmetric routing due to MPLS TE paths, dual upstream ISPs, or BGP route leaks. FortiGate stateful inspection expects to see both directions of a flow. The better solution is to fix the routing asymmetry at the network layer rather than enabling asymmetric routing workarounds, which can mask session hijacking.
Firewall policies accumulate over years. A policy audit on a client FortiGate recently revealed hundreds of rules, more than a quarter of which had not matched traffic in six months, and dozens referencing decommissioned IP ranges. FortiManager’s policy hit-count analysis combined with periodic cleanup sprints keeps the policy base maintainable and auditable—a requirement for both ISO 27001 Annex A.8.22 and DPDP compliance demonstrations.
Deploying SSL inspection without distributing the FortiGate’s CA certificate to all endpoints breaks HTTPS for users. Plan the certificate rollout—via Group Policy, Intune, or FortiClient—before enabling full inspection in enforcement mode. Run in monitor mode first to identify applications that pin certificates and will break under inspection, such as certain banking apps and government portals.
India’s Digital Personal Data Protection Act 2023 requires data fiduciaries to implement “reasonable security safeguards.” While the Act deliberately avoids prescribing technical controls, interpretive guidance points toward access control, encryption in transit, logging, and incident response. FortiGate directly supports compliance with these areas:
FortiGate configuration alone does not make an organisation DPDP compliant—you also need policies, a DPO appointment, consent management, and breach notification processes. But a correctly deployed and monitored FortiGate estate substantially supports your compliance evidence portfolio.
A correctly configured FortiGate managed by an under-resourced internal team will drift. Signatures fall out of date, log forwarding silently breaks when a SIEM IP changes, and critical patches are applied months late because there is no structured maintenance window programme. PJ Networks regularly sees this pattern when onboarding clients from self-managed environments.
PJ Networks’ managed FortiGate service combines hardware procurement and deployment, 24/7 NOC monitoring via PrahiX Ora’s NMS and SIEM, structured patch management against Fortinet PSIRT advisories, and monthly configuration audit reports. For organisations where network security is critical but not a core competency, this model provides enterprise-grade outcomes without the staffing overhead of building it internally.
If you are evaluating your FortiGate deployment posture—whether planning a fresh rollout, auditing an existing estate, or deciding between in-house and outsourced management—PJ Networks is available for a no-obligation assessment. Reach out at pjnetworks.com.