Just got handed this "cost optimization" project from the bean counters. They're looking at our stack and asking why we're paying for both FortiGate's web filtering subscription and Cisco Umbrella for DNS-layer security. Classic.
From my night-shift vantage point, running both feels like wearing a belt *and* suspenders. But is it redundant? Umbrella's great for roaming clients and catching callbacks from already compromised hosts at the DNS layer. FortiGate's filtering, however, gives you that full SSL inspection and application-level control on your network perimeter. They overlap in the "block bad sites" category, but the enforcement point and depth are different.
Here's my raw, 3 AM take:
* **Umbrella** is your first, lightweight, off-network sentinel. It's fast, agent-based, and handles anything that bypasses your corporate firewall (coffee shop warriors, I'm looking at you).
* **FortiGate Web Filter** is your heavy lifter at the edge. Need to decrypt HTTPS to see what's *inside* that "benign" cloud storage request? That's FortiGate. Granular policies per user group, application control tied to the same policy? Also FortiGate.
The real question is your threat model. If you just need basic domain blocking and malware protection for a distributed workforce, you might lean on Umbrella and drop the FortiGate sub. But if you have compliance needs (like PCI DSS) that require deep inspection of all traffic hitting your data centers, or you need to control specific web app usage, the FortiGate subscription is doing a job Umbrella fundamentally can't.
Personally, I'm keeping both for now. The FortiGate logs give me the granularity I need for post-incident forensics when something *does* slip through. But I'm curious—has anyone else run this dual setup and cut the cord on one? Did you regret it after the next security audit?
Pager duty survivor.
NightOps
Been the security guy at a mid-sized financial services shop (~800 users) for a decade, responsible for PCI-DSS. We run both: Umbrella for roaming and FortiGate with full SSL inspection at the perimeter. Here's the breakdown from the audit logs.
**Enforcement Point:** Umbrella works at the DNS layer, period. That means it's blind to anything using a hardcoded IP or DoH. FortiFilter sees the actual encrypted tunnel, decrypts it, and applies policy to the real HTTP traffic. You can't stop a malicious file upload to a "benign" Google Drive without the latter.
**Inspection Depth:** Umbrella sees a domain request. FortiGate sees the full URL, path, and content type after SSL decryption. For compliance, that's the difference between "we block porn sites" and "we block porn sites and can prove no one uploaded a SSN to Pastebin over HTTPS."
**User/Group Granularity:** FortiGate policies tie directly to your on-prem AD groups and can mix app control, web filter, and IPS in one rule. Umbrella's identity is more reliant on its roaming agent or your VPN; policy is simpler, often just a few groups.
**Performance & Complexity:** Full SSL inspection on a FortiGate is a CPU killer and a config headache with all the trusted CAs. At our last capacity test, turning it on for all traffic dropped throughput by about 40% on our 6000Es. Umbrella adds no latency worth measuring.
My pick: If you're in a regulated industry or your users are primarily on corporate networks, drop Umbrella and keep FortiGate's subscription - the inspection depth is non-negotiable. If you have a fleet of roaming laptops and a relaxed compliance environment, keep Umbrella and drop the FortiGate web filter. Tell us your industry and what percentage of your traffic is from off-net users.
Trust but verify