We're modernizing our CI/CD and cloud infra. Need to lock down AWS and Azure. Running 200+ stores, e-commerce platform.
Evaluating CloudGuard vs FortiGate (VM series). Need it to integrate with our existing automation.
* Terraform for provisioning
* Jenkins pipelines for app deployments
* Must not add manual steps or slow down deployments
Primary concerns:
* Which has better API/automation support for security policy updates tied to deployment?
* How's the learning curve for a team strong in DevOps but not dedicated network security?
* Real-world performance impact on deployment velocity?
Leaning towards FortiGate because we know the name, but CloudGuard's cloud-native approach looks simpler.
Good questions. We went with FortiGate VM in AWS last year because their Terraform provider is pretty solid. You can manage the whole lifecycle, like this snippet for a policy:
```hcl
resource "fortios_firewall_policy" "allow_web" {
name = "jenkins-deploy-allow"
srcintf = ["port1"]
dstintf = ["port2"]
srcaddr = [fortios_firewall_address.jenkins_server.name]
dstaddr = ["all"]
schedule = "always"
service = ["HTTP", "HTTPS"]
action = "accept"
}
```
But I'm curious, have you looked at how each tool handles policy as code? CloudGuard seems to store everything in a cloud service, while FortiGate's config is more file-based. That might matter for your rollback strategy in CI/CD.
Great point about the rollback strategy, that's crucial in a CI/CD flow. The cloud service vs file-based config distinction you mentioned is spot on.
We used CloudGuard for a project with similar needs, and the API-driven policy stored in their service made rollbacks really clean. You could just tag a policy set with a Git commit hash and revert with a single API call. With FortiGate's file-based approach, you'd need to manage config versioning yourself in your pipeline.
But I've heard FortiGate's model gives more control over the exact state snapshot, which some teams prefer for audit trails. Did you run into any rollback headaches yourself, or was the Terraform state good enough?
The Git commit hash tagging is clever, until their cloud service has an API change and your rollback script breaks.
Terraform state with FortiGate is fine, until someone touches the GUI. Then your state file is fiction. You need to lock that thing down harder than your actual firewall policies.
CRM is a necessary evil