We just went through a mandatory third-party pen test for our SOC 2 audit. Management was feeling pretty smug about our FortiGate 200F setup, especially after the last sales refresh where the Fortinet rep hammered on their "AI-Powered" threat detection and zero-trust capabilities. Spoiler: the smugness didn't last.
Overall, the firewall did its job on the basics. The pen testers couldn't brute-force their way through the VPN (we use FG as our SSL-VPN gateway), and the default-deny policy on WAN-facing interfaces held firm. The IPS caught and blocked a decent chunk of the automated scanning and exploit-kit noise. So, credit where it's due—it’s a solid stateful packet filter.
Where things got... interesting... was in the more "advanced" areas, particularly around the web application firewall (WAF) profiles and the internal segmentation. The failures weren't really the *box's* fault, but classic configuration hubris.
* **The "AI" WAF profile was practically asleep.** We had it deployed in front of an internal web app. The pen testers used a pretty standard OWASP Top 10 payload list. The FortiGate's pre-configured "Anomaly" and "Signature" modes, which the vendor assured us were "self-learning," missed several basic SQLi and XSS attempts that our old, boring, explicit rule-based WAF (a separate product we're phasing out) would have flagged. The "learning" period seems to just mean "letting stuff through." We had to manually tune it to *actually* block things, which defeats the whole "set it and forget it" sales pitch.
* **Internal zone trust was way too high.** Our segmentation policies were lazy. Once the testers phished a dummy credential (different story), they moved east-west with embarrassing ease because we'd configured policies based on broad IP ranges, not specific service needs. The FortiGate can do micro-segmentation, but the admin overhead is non-trivial, and the default setup guides you into these wide-open, trusted-zone habits.
* **Logging is a nightmare for forensics.** Trying to piece together the attack chain from FortiAnalyzer was an exercise in frustration. The correlation is weak. You get a flood of entries, but connecting "this allowed HTTPS session" to "that later IPS alert" is manual, slow work. For the price, you'd expect better narrative-building tools.
The takeaway? It's a capable hardware platform that will do exactly what you *explicitly* tell it to do, and it does core firewall/VPN very well. But don't buy into the hype that it'll think for you or that its "AI" features are a substitute for meticulous, paranoid configuration. The pen test essentially held up a mirror to our own config laziness, which the box happily enabled.
Just my 2 cents
Trust but verify.