Network and access security
I design and build networks where traffic between zones passes through the firewall, and remote access is encrypted and controlled. Most of my work is on Fortinet equipment: FortiGate, FortiSwitch, FortiAP and FortiAnalyzer.
Network segmentation
I divide the network into zones so that an infected computer cannot reach the servers and management devices.
In many offices and companies, computers, servers, printers and the training room all share one network. Every device can then talk to every other one, and a visitor's infected laptop has the same path to the server as the accountant's computer.
Below is an example of how a public office network was divided in one of my projects. The numbers and addressing always come from an on-site inventory.
| Zone | What it contains | Default rule |
|---|---|---|
| Management | firewall, switches, management interfaces of storage and other devices | access only from authorised administrator workstations |
| Servers | servers and infrastructure services | access only from the zones that need it, on the ports they need |
| Users | staff computers | access to servers, printers and the internet according to policy |
| Printers | printers and multifunction devices | no free traffic to users or the management zone |
| Training room | trainees' laptops | internet yes, internal network no |
| Guests | guest Wi-Fi and personal devices | internet yes, internal network no |
Because only then can you enforce access policies, log who connects to whom and use security inspection. The switches work as the access layer, not as a way around the firewall. Internal traffic does not go through full inspection, so the device is not overloaded.
What I deploy
Firewalls
- FortiGatesupplying and replacing the firewall, with configuration migration, policy clean-up and optimisation, testing and acceptance
- High-availability clusterstwo firewalls working together, so the failure of one does not cut the organisation off
- FortiAnalyzerfirewall logs and reports, the basis for incident analysis and evidence for the auditor
Remote access
- Site-to-site IPsec VPNpermanent, encrypted connections for branches and partner systems
- VPN for staffFortiClient with access only to the resources people need
- Multi-factor authentication (MFA)a second factor when signing in to the VPN and to systems exposed to the internet
Switches and Wi-Fi
- FortiSwitchswitches managed centrally from the firewall, connected in a ring with 10 Gb/s links, with PoE for access points and cameras
- FortiAP and UniFiWi-Fi for staff, guests and training rooms, each network in its own zone
When the VPN “can't see” a resource
A typical case from practice: an employee connects over VPN but cannot reach a system at the other site.
What I check
- routes for the VPN address pool, including leftovers from old configurations
- policies between tunnels (hairpin traffic) and address translation
- phase 2 selectors on both ends of the tunnel
- routes pushed to the VPN client (split tunnelling)
What comes out of it
The problem rarely has a single cause. After diagnosis I remove unnecessary rules and routes, tidy up the configuration and document the changes, so the next administrator does not have to start from scratch.
How I work
- On-site inventoryaddressing, DHCP, DNS, directory services, servers, storage and devices with static addresses
- Zone and policy designa VLAN plan, rules for traffic between zones and a list of exceptions for approval
- Phased rolloutin maintenance windows, with a rollback plan for every step
- Testing and acceptancechecking access from every zone and signing an acceptance report
- Documentationnetwork diagram, addressing plan and a description of the firewall rules
Other cybersecurity services
A network to sort out or a firewall to replace?
Describe what you have and I will suggest the scope of work and the order of steps.