适合谁
Organizations with a Vientiane head office and provincial branches that want site-to-site VPN and ISP failover in one box.
概述
Fortinet today
Fortinet is a US company headquartered in Sunnyvale, California. Its core product is the FortiGate firewall, built around FortiASIC chips that Fortinet designs itself, which is why even small units inspect traffic faster than their size suggests. Every model runs the same operating system, FortiOS. Version 8.0 shipped in April 2026, although most organizations still run 7.4 or 7.6.
How the product families fit together
- FortiGate ranges from small branch units (70G, 90G) through head-office models (120G, 200G) up to data center chassis, plus FortiGate-VM for VMware, Proxmox and public cloud. SD-WAN is part of FortiOS and needs no separate licence.
- FortiSwitch and FortiAP are managed from the FortiGate's own interface through FortiLink. This is the heart of the Security Fabric: every switch port and access point sits on the same screen as your firewall policy.
- FortiManager controls policy across many FortiGates, and FortiAnalyzer stores logs and produces reports.
- FortiClient and FortiEDR cover endpoints, FortiMail covers email, and FortiSASE protects staff working away from the office.
Licensing and changes worth knowing
A FortiGate is sold as hardware plus a 1, 3 or 5-year bundle such as ATP, UTP (Unified Threat Protection) or Enterprise Protection. The bundle combines FortiCare (support and RMA) with FortiGuard services (antivirus, IPS, web filtering). When it lapses, the box still passes traffic, but anything that depends on updates stops protecting you.
The change that catches most people out: from FortiOS 7.6.3 onwards, Fortinet removed SSL VPN tunnel mode and replaced it with IPsec VPN, which can run over TCP 443. Old settings are not migrated, so the remote-access VPN has to be rebuilt before the upgrade.
FortiGate fits almost any size, from a shop with ten PCs to a bank with branches in every province. It is strongest for organizations with a Vientiane head office and several branches that want site-to-site VPN and dual-ISP failover in a single box.
优势
- SD-WAN, site-to-site VPN and dual-ISP failover are built into FortiOS on every model with no extra licence, which suits organizations with provincial branches.
- FortiASIC chips let small units such as the 70G run IPS and antivirus together without slowing to a crawl, so small branches don't need oversized hardware.
- With FortiSwitch and FortiAP added, firewall, switching and Wi-Fi are managed from one screen, which saves a two- or three-person IT team a lot of time.
- Plenty of engineers in Thailand and Laos know FortiGate, and Fortinet's entry-level training is free online, so bringing a new admin up to speed is not hard.
选型前须知
- FortiGuard and FortiCare bundles must be renewed. Without them the box keeps routing, but IPS, antivirus and web filtering stop updating and a failed unit won't be replaced.
- FortiOS has had serious vulnerabilities in its internet-facing VPN components that were exploited in real attacks. Someone has to watch the advisories and keep firmware current.
- The removal of SSL VPN tunnel mode in FortiOS 7.6.3 means planning a move to IPsec and re-deploying FortiClient to staff before you upgrade.
- There are many features and menus move between FortiOS versions. Careless setups, such as leaving the admin page reachable from the internet, are a common finding.
在老挝的使用
FortiGate is one of the firewalls we see most often in Lao organizations. Hardware and licences come in through distributors in Thailand. Small and mid-range models are usually in stock; larger units can take several weeks including customs.
What we see on sites:
- Power: desktop FortiGates run on an external adapter, and that adapter usually dies before the firewall when evening voltage sags or rainy-season lightning hit. Always put the unit on a UPS and keep one spare adapter.
- Internet: use SD-WAN with two ISPs that genuinely take different paths, not two packages from the same provider.
- Provincial branches: models with built-in Wi-Fi, or with a 4G/5G modem attached, help small offices that have no second fiber line.
- People: engineers who can set up a basic FortiGate are not hard to find in Vientiane. People with real FortiManager and FortiAnalyzer experience are fewer.
Sectors where it is common: banks and microfinance, mining companies, hotels, factories and multi-branch retail.
与其他方案对比
Sophos Firewall is the better fit if you want the firewall and endpoint protection to work together and need an MDR team watching overnight. Palo Alto Networks suits banks and large enterprises with a dedicated security team that want fine-grained policy by application and user. For many small branches that only need simple VPN, WatchGuard is also a sensible choice. Pick FortiGate when you want SD-WAN, VPN and switch and Wi-Fi management in one box with good performance for the money.
产品线
- FortiGate
- FortiSwitch
- FortiAP
- FortiAnalyzer
- FortiManager
- FortiClient
- FortiEDR
- FortiMail
- FortiSIEM
- FortiSASE
使用此品牌的解决方案
下一代防火墙 (NGFW)可识别应用和用户的防火墙，具备 IPS、网页过滤、HTTPS 检测和 VPN，按全功能开启的实际性能选型。
分支机构 SD-WAN外省分支同时使用两条互联网线路，一条故障另一条数秒内接管，全程加密。
安全远程访问 (VPN/ZTNA)员工和外包人员通过 VPN 或 ZTNA 加 MFA 随时随地访问内部系统，只能看到所需内容。
零信任与网络准入控制 (NAC)借助 802.1X 和 NAC，在接入前验证每个用户和设备。插上网口不再等于能访问服务器。
终端防护与 EDREDR 监控行为而不只依赖病毒库，可在勒索软件运行中途拦截，并立即将中毒电脑隔离出网络。
邮件安全通过过滤、SPF/DKIM/DMARC 和沙箱，拦截钓鱼邮件、冒充老板或供应商的诈骗邮件 (BEC) 及恶意附件。
SOC 与 SIEM 安全监控防火墙、服务器和终端日志汇入同一 SIEM，有专人盯告警，出事时有清晰的处置预案。
企业局域网与交换核心–接入架构的局域网，划分 VLAN，上联冗余，PoE 供电充足。一根插错形成环路的网线，再也不会让整栋楼断网。
企业 Wi-FiWi-Fi 6/6E/7，AP 点位依据实测部署。会议室满员也能用，走动通话不断线，采用 WPA3 加密。
工业网络 (OT)耐粉尘、高温和振动的工业交换机，环网冗余、IT/OT 隔离，适用于工厂和矿山。
酒店客房 Wi-Fi客人轻松连接，每间客房信号强，客人之间相互隔离，自定义登录页面并对接 PMS。
网络监控 (NMS)所有设备、链路和互联网线路集中在一个屏幕，用户报障之前 IT 就已收到告警。
漏洞评估与渗透测试扫描并测试系统、网站和网络，抢在他人之前发现弱点，报告按修复优先级排列。
企业邮箱与域名以贵公司名义注册域名（.la、.com），企业邮箱配置 SPF、DKIM 和 DMARC，邮件可送达收件箱且无法被冒充。
DDoS 防护与 Web 应用防火墙 (WAF)为老挝的网站、预订页面、API 和 VPN 门户提供 WAF 与 DDoS 防护，含策略调优和持续监控。
偏远站点上网：4G/5G、卫星、微波为光纤到不了的营地、工地和乡村分支提供互联网和办公网络连接。常见问题
If our FortiGate licence expires, will the internet stop working?
No. Firewalling, routing and VPN keep working. What stops is updates for IPS, antivirus and web filtering, plus your right to a replacement if the unit fails. The box stays up, but it no longer protects you from new threats.
Our staff use FortiClient SSL VPN. What happens when we upgrade FortiOS?
From FortiOS 7.6.3, SSL VPN tunnel mode is gone and the old settings are not carried over. Build an IPsec remote-access VPN first, test it with a few users, then upgrade. IPsec can be set to use TCP 443 if hotel or mobile networks block other ports.
Can we use FortiGate with another brand of switch, such as Cisco or Aruba?
Yes. VLANs, LACP and routing are standards every brand supports. What you lose is seeing and managing switch ports from the FortiGate screen. If your existing switches are healthy there is no need to replace them straight away.
Which bundle should we buy: ATP, UTP or Enterprise?
For most organizations UTP is enough: it covers IPS, antivirus, web filtering and DNS filtering. ATP suits branches on a tight budget that filter the web elsewhere. Enterprise adds risk and configuration assessment services and suits banks or organizations with heavy reporting needs.
所有品牌名称和商标归其各自所有者所有。除非另有明确说明，提及某品牌并不代表与其存在合作关系。产品均通过正规分销渠道采购。
发给我们建筑平面图或几张现场照片
我们会先询问一些细节，再给出初步设计方案。首次咨询免费，可用老挝语、泰语或英语，通过 WhatsApp 或 Facebook 主页联系。