Case studies · Security & Networking
Manufacturing
firewall tiers — Sangfor outside, FortiGate HA inside
broadband lines load-balanced at the edge
End-of-life is a countdown, not a suggestion: once the Check Point 770 passed its April 2025 EOL and the SonicWall NSA2650 approached April 2026, the site was running its only perimeter on boxes that would soon stop receiving security updates. Three broadband lines came into the building, the internal network ran largely flat, and none of the aging switching gave failover any real path to take. The customer wanted more than a like-for-like swap — better security, reliability and redundancy — and the replacement had to be installed into a live network, out of office hours, without the business noticing on Monday morning.
The design separates what the two firewall tiers are for. Outside: two Sangfor NGAFs in NAT mode carry the internet — WAN protection and load balancing across the three broadband lines, fed through a managed uplink switch with redundant links so no line or device strands the edge. Inside: two FortiGate 60Fs in HA pair own what the outside never sees — internal segmentation, server access, DMZ and policy — coordinated so the two tiers enforce one coherent rule set rather than arguing with each other.
Switching was rebuilt to match. Two 48-port Ruijie core switches carry server and client connectivity with redundant dual-link uplinks into the FortiGate pair, VLANs split the broadband uplink traffic from the internal segments — server, staff, guest — and trunking and link aggregation close the remaining single paths. Nothing upstream of a user relies on one box.
Execution respected a live site: appliances mounted and power-on tested, firmware taken to the vendor-recommended level before configuration, the existing policy set migrated and tested rather than written blind, post-installation connectivity verified, and configurations backed up — all scheduled in non-office-hours windows, closed with a skills-transfer handover to the customer's team.
Five-year coverage was priced into the design, not sold later: full security bundles on both tiers — Sangfor Premium (VPN, URL filtering, application control, IPS, botnet and email protection) and Fortinet UTP (IPS, advanced malware protection, application control, URL/DNS filtering) — same-day or 24x7x4 hardware swap on both, plus our own 8x5 engineering support for both firewalls for the full term.
The site now runs behind two deliberate layers instead of one dying box: internet load-balanced across three lines under Sangfor protection, internal traffic segmented and policed by a FortiGate HA pair, switching with no single points of failure, and a five-year support runway on every device — with policy migrated, staff handed over, and the EOL countdown ended.
Whether it’s a critical server issue or a long-term digital transformation project, our team is ready to assist. Reach out and experience ITR’s expert support that actually works.
