FortiGate / FortiWiFi

The security checkpoint for your network. Everything going between the internet, your buildings and your internal systems passes through it, and it stops what shouldn’t get through. FortiWiFi is the same device with Wi-Fi built in, for small sites.

Every packet is compared against policies you write, based on source, destination, user, application and content. Custom security chips (ASICs) do much of the inspection work, so traffic can be scanned deeply without slowing the network as much as a general-purpose processor would. FortiGuard subscriptions keep its threat knowledge current, and built-in SD-WAN picks the best available internet link.

This is the main control point for inmate technology. Corrections administrators need to know what an inmate did, when, from which device and through which application, and they need to enforce what’s allowed. A FortiGate can do both, by keeping inmate networks apart from staff systems, allowing only approved destinations, and logging each session.

• Blocks inmate-to-inmate traffic, so tablets, kiosks and classroom devices can’t talk directly to each other.
• Limits inmates to approved services, such as education, messaging and legal research, and blocks everything else by default.
• Applies schedules by housing unit or program, so access stops at lights-out, during lockdowns or outside class times.
• Logs the user or device, destination, application and time of each session, which supports investigations.

• Inmate-to-inmate blocking: deny traffic inside the inmate zone, so each device can reach only approved services and not its neighbors.
• Default-deny allowlisting: approved inmate destinations are named, and all other traffic is dropped and logged.
• Firewall schedules: rules can turn access on and off by time of day for each unit or program.
• Application control and web filtering: VPNs, proxies, peer-to-peer tools, games and social media can be blocked even when they try to hide on common ports.
• Segmentation: each system gets its own VLAN and firewall zone, and only named traffic may cross, for example a camera recorder to its viewing station and nothing else.
• Identity-based rules: integrating with Active Directory lets policy follow the user, so a records clerk and a shift commander can get different access from the same subnet.
• Encrypted site links: IPsec tunnels protect traffic between facilities, annexes and state interfaces, while SD-WAN fails over when a circuit drops.
• Inspection of encrypted traffic: SSL inspection exposes threats hidden in HTTPS, within the limits of your privacy and legal rules.