Skip to content

Migrating a firewall while redesigning the security boundaries

I used a firewall migration to replace accumulated rules with clearer zones, routing, policy, and management boundaries.

July 2026 · Independent engineering lab · Details sanitised

The problem

A migration from an older FortiGate appliance and legacy FortiOS configuration was an opportunity to examine the policy model rather than copying it unchanged onto newer hardware.

The review found broad rules, internal source NAT that obscured device identity, stale routing configuration, legacy VPN and administrative settings, and limited protection for traffic addressed to the firewall itself.

The path through the system

  1. Device zone
  2. Explicit policy
  3. Routed source identity
  4. Filtered BGP
  5. Site connectivity
  6. Service zone

What I did

I audited the existing configuration by traffic path and control-plane function, then separated what needed to be preserved from what had accumulated as legacy behaviour. The target design used intentional zones and narrowly described flows rather than treating the migration as a configuration-format exercise.

  • Mapped required traffic between logical trust zones before translating policies.
  • Removed unnecessary internal source NAT so logs and downstream controls retained the real source identity.
  • Tightened BGP neighbours and filtering around the routes the environment actually needed.
  • Updated site connectivity toward IKEv2 and reviewed legacy administrative and monitoring configuration.
  • Added deliberate local-in and denial-of-service controls for the firewall's own attack surface.

What changed

The migrated environment uses clearer segmentation, explicit inter-zone policy and more observable internal traffic. Routing, VPN and management-plane controls now reflect the intended architecture rather than inherited defaults and historical exceptions.

The work also produced a cleaner base for publishing selected services without bypassing the central routing, logging and enforcement boundary.

A platform migration is most valuable when it tests the assumptions embedded in the old configuration. Preserving connectivity does not require preserving obsolete trust decisions.

Source identity and explicit network boundaries are operational features as well as security controls: they make later incidents easier to explain.

Technologies

FortiGate · FortiOS · Firewall policy · Network segmentation · BGP · IKEv2 / IPsec · Local-in policy · Network security