Grant County Multi-Site Fortinet Modernization

CASE STUDY

Public Sector  |  Multi-Site Network Modernization  |  AirGap Labs

Grant County: Multi-Site Fortinet Modernization

Complex firewall migration, network redesign, and compliance-driven cutover across a multi-vendor, multi-site public sector environment.

Multi-site

Sites involved across active and planned deployments

BGP / OSPF / IPsec

Routing protocols configured across all sites

July 8

Compliance cutover deadline - met with zero rework

4

External dependency chains coordinated simultaneously

The Challenge

Grant County needed to modernize a sprawling, mission-critical network across multiple physical sites - replacing aging Fortinet hardware, redesigning network topologies, and meeting a hard compliance deadline for their most sensitive firewall environment. What appeared at kickoff to be a hardware refresh became a full network engineering engagement the moment the real-world constraints came into view.

Each site carried its own topology, its own dependency chain, and its own risk profile. The EPH-SEC-FW 1500D - the environment with the hardest compliance requirement - sat at the intersection of BGP routing changes, an ISP autonomous system migration, and Juniper firewall integration work happening in parallel. A misconfiguration in that environment could affect both compliance posture and operational continuity simultaneously.

The scope also evolved as the project progressed. New customer locations entered scope, architectural requirements changed as constraints became visible, and the original deployment plan required redesign - all while the July 8 compliance deadline remained fixed.

The Approach

Site-by-site cutover planning. Rather than treating this as a single large migration, AirGap Labs developed individualized cutover plans for each site - each accounting for site-specific topology, dependency chains, and risk tolerance - validated with the client before execution.

Lab validation before every production change. Every significant topology change was designed and tested in a lab environment before touching production. This included the Juniper firewall integration, private IPsec connectivity design, and the updated EPH-EDGE network architecture - all validated against real-world traffic patterns and failure scenarios first.

Mission-critical EPH-SEC-FW migration. The highest-stakes element was the 1500D-to-901G replacement in the EPH-SEC-FW environment. AirGap Labs fully configured, validated, and staged the 901G - including all BGP, OSPF, IPsec, VLAN, HA, and FortiManager integration - with the cutover coordinated for July 8 to meet the compliance requirement. The 60F-to-71G migration at a second site was completed first, producing a validated playbook for the remaining replacements.

Multi-vendor dependency coordination. The project required simultaneous coordination across four external chains: ISP teams managing AS changes, Juniper teams handling new firewall deployments, hardware vendors on 25G SFP availability, and the county's internal infrastructure team. AirGap Labs served as the technical integration point - tracking blockers early and adjusting cutover sequencing to maintain forward momentum despite factors outside direct control.

Technical Scope

Protocols & Technologies Hardware & Platforms

• BGP (including ISP AS changes)

• OSPF routing

• IPsec VPN (private connectivity)

• VLAN design and segmentation

• High Availability (HA) configuration

• FortiManager integration

• FortiGate 60F → 71G (completed)

• FortiGate 1500D → 901G (staged, July 8)

• Additional 1500D replacements (planned)

• Juniper firewall integration

• Data center connectivity

• EPH-EDGE architecture redesign

Outcomes

  • 60F-to-71G migration completed - validating the replacement playbook for all subsequent sites and establishing a repeatable cutover process for the remaining 1500D environments.
  • EPH-SEC-FW 1500D-to-901G fully configured, validated, and staged - compliance cutover executed on July 8 with zero rework required. All BGP, OSPF, IPsec, VLAN, HA, and FortiManager integration pre-validated in lab.
  • Multiple network topologies redesigned and lab-validated before production deployment, eliminating cutover risk across complex multi-vendor environments where a single misconfiguration could have caused a compliance failure.
  • Four external dependency chains actively tracked and managed - ISP AS changes, Juniper deployments, hardware availability, and the county's internal infrastructure team - preventing project stalls despite factors outside AirGap's direct control.
  • Prioritized roadmap of remaining 1500D replacements developed and agreed with the client, ensuring continuity of progress beyond the initial engagement scope with no loss of momentum between phases.
  • Engagement expanded to include new locations, design workshops, and architecture validation - evolving from a hardware replacement project into an ongoing network engineering partnership.

AirGap Labs is a Fortinet Engage Preferred Services Partner based in Irvine, CA, specializing in complex multi-site Fortinet deployments across public sector, enterprise, and critical infrastructure environments.

Senior-level network engineering from design and lab validation through production cutover and ongoing architecture partnership.

airgaplabs.com

Irvine, CA  |  Fortinet Engage Preferred Services Partner
Back to blog