OT Network Security: Inland Empire Utilities Agency

CASE STUDY  |  SLED PORTFOLIO

Regional Water & Wastewater Utility  |  Southern California  |  AirGap Labs

OT Network Security: Inland Empire Utilities Agency

Replacing a legacy ASA firewall with an HA FortiGate pair in a live operational technology environment serving 700,000 residents - procured without competitive bid via OMNIA partnership.

700K+ People served across 242 square miles of Southern California

HA pair Active/passive FortiGate deployment - zero unplanned downtime

OMNIA Cooperative contract - hardware and services without competitive bid

Follow-on IEUA invited AGL and Fortinet to bid As Needed Cybersecurity Services

The Challenge

Inland Empire Utilities Agency is a wholesale water supplier and regional wastewater treatment facility serving approximately 700,000 people across 242 square miles of Southern California. As critical infrastructure, IEUA operates in a tightly regulated environment where network security directly intersects with physical plant operations - industrial control systems, SCADA networks, and operational technology that cannot tolerate unplanned downtime.

IEUA was running a legacy Cisco ASA firewall that had reached end of strategic life for their environment. They needed to modernize to a next-generation firewall platform capable of handling their OT-heavy network - with visibility into industrial protocols, deep integration with threat intelligence, and the resilience of a high-availability architecture. A misconfiguration that takes down an IT network is recoverable. One that affects treatment plant operations is not.

The engagement carried two additional constraints beyond the technical migration. First, as a public agency, IEUA's purchasing processes typically require competitive bidding. Second, the OT environment demanded a migration approach that eliminated risk to operational continuity entirely - meaning lab validation before any production change and a cutover designed for zero disruption.

The Approach

OMNIA - eliminating the bid process. AirGap Labs and Fortinet structured the engagement under the OMNIA Partners cooperative purchasing contract, allowing IEUA to acquire both hardware and professional services without going to competitive bid. This compressed the procurement timeline from months to weeks and eliminated the administrative burden of an RFP process while remaining fully compliant with public purchasing requirements. Identifying the right cooperative contract vehicle is increasingly a core competency for SLED-focused partners - and it directly influenced IEUA's ability to move quickly on a security modernization with real urgency.

HA FortiGate pair - no single point of failure. The replacement architecture centered on a high-availability FortiGate pair in active/passive configuration, ensuring that a hardware failure at any point in the migration or post-deployment operation would not result in a network outage. In an OT environment where continuous process monitoring is non-negotiable, HA was not optional. AirGap Labs mapped the existing ASA policy sets to FortiGate equivalents and validated configurations before any production cutover.

OT environment integration. The engagement required direct integration with IEUA's operational technology environment - industrial control systems and SCADA networks with distinct security requirements, legacy protocols, air-gap considerations, and sensitivity to latency that IT networks can tolerate. FortiGuard's OT-aware threat intelligence and FortiGate's industrial protocol inspection capabilities were central to making the new platform fit for purpose - not just a firewall replacement, but a meaningful upgrade in visibility and control over traffic the ASA had treated opaquely.

Solutions Deployed

FortiGate (HA Pair)	FortiGuard
Next-Generation Firewall - Active/Passive HA Replacing the legacy Cisco ASA with a Fortinet HA pair. Zero operational disruption to water and wastewater treatment systems during migration. Industrial protocol inspection and SCADA-aware traffic visibility from day one.	Threat Intelligence & OT Security Services FortiGuard OT-aware threat intelligence providing ICS/SCADA-specific indicators and industrial protocol-level detection - security coverage the ASA platform could not provide.

Outcomes

• Legacy Cisco ASA replaced with an HA FortiGate pair - zero operational disruption to IEUA's water and wastewater treatment systems during migration. No unplanned downtime in a critical infrastructure environment where downtime is not an option.
• Full OT environment integration achieved, giving IEUA next-generation visibility into industrial protocol traffic for the first time - SCADA-aware detection and ICS-specific threat intelligence that the ASA could not provide.
• Procurement completed under OMNIA cooperative contract, eliminating competitive bid requirement and compressing the acquisition timeline significantly - months reduced to weeks for a security modernization with genuine urgency.
• IEUA satisfaction converted to follow-on opportunity - the Agency has since invited AirGap Labs and Fortinet to jointly submit a bid for As Needed Cybersecurity Services, converting a hardware replacement engagement into a potential long-term managed security partnership.
• Three critical SLED capabilities demonstrated in one engagement: technical depth to navigate OT environments safely, procurement expertise to structure deals within public agency constraints, and relationship quality to convert project delivery into an ongoing security partnership.

AirGap Labs is a Fortinet Engage Preferred Services Partner based in Irvine, CA, with deep expertise in OT/ICS security, SD-WAN, firewall architecture, and cooperative procurement vehicles including OMNIA Partners, NASPO, and CalSLP.

airgaplabs.com Irvine, CA  |  Fortinet Engage Preferred Services Partner