Use Case & Context
# Fortinet OT Deployment - Network Architecture Design
## Use Case
This comprehensive network architecture design documents a complete Operational Technology (OT) security deployment for a multi-site pipeline infrastructure. The project demonstrates expertise in securing industrial control systems while maintaining seamless connectivity across distributed locations.
## Project Overview
**Client Type**: Energy/Pipeline Infrastructure
**Project Duration**: March 2024 - May 2024
**Role**: Lead Network Architect & Security Engineer
**Status**: Deployed & Operational
### Key Objectives
- Secure 11 remote pipeline sites with PLC and flow computer monitoring
- Establish hub-spoke SD-WAN topology with FortiGate appliances
- Implement multi-cloud AWS integration (FortiManager/FortiAnalyzer)
- Deploy ruggedized hardware for harsh environmental conditions
- Create redundant WAN connectivity (Fiber, Starlink, Cellular LTE)
## Technical Architecture
### Network Topology
The design implements a **hub-spoke SD-WAN architecture** with the following components:
**Hub Site:**
- Fortinet FortiGate 60F (FG-60F) with OT Security Service licensing
- Primary hub gateway for all spoke site connectivity
- Direct AWS VPC peering for centralized management
**Spoke Sites (11 locations):**
- Fortinet FRG70F-3G4G rugged SD-WAN appliances
- Allen-Bradley PLCs (5069-L33ER controllers)
- Micro Flow Computer monitoring equipment
- Cellular LTE failover for WAN redundancy
**Cloud Infrastructure (AWS):**
- FortiManager (centralized policy management)
- FortiAnalyzer (logging and analytics)
- Segmented VPC architecture (Prod/Mgmt/DMZ/Transit)
### WAN Connectivity Strategy
Each critical site includes **triple-redundant WAN paths**:
1. **Primary**: AT&T Fiber (high-bandwidth, low-latency)
2. **Secondary**: Starlink satellite (backup, remote locations)
3. **Tertiary**: Verizon FirstResponders cellular (emergency failover)
### Security Segmentation
**Product/Crude Site Segmentation:**
- Separate VLANs for product vs crude handling operations
- Micro-segmentation between control zones
- OT security policy enforcement at edge
**3rd Party Integration:**
- Secure tunnels to Houston control center
- Dedicated connection to Las Vegas backup operations
- Restricted access policies for vendor support
## Engineering Deliverables
This documentation package includes:
1. **High-Level Topology Diagrams** (Pages 1-3)
- Hub-spoke overview
- AWS cloud architecture
- Site interconnections
2. **Detailed Site Designs** (Pages 4-7)
- Individual spoke site layouts
- PLC/SCADA equipment integration
- Local network segmentation
3. **IP Addressing Scheme** (Pages 8-9)
- Subnet allocations
- VLAN assignments
- Routing protocol details
## Technologies Demonstrated
- **SD-WAN**: Fortinet Secure SD-WAN with application-aware routing
- **OT Security**: Fortinet OT Security Service for industrial protocol inspection
- **Cloud Integration**: AWS VPC peering and multi-region architecture
- **High Availability**: Redundant WAN, failover automation, cellular backup
- **Ruggedized Hardware**: FRG70F-3G4G for extreme temperature/vibration environments
## Key Achievements
✅ **Zero Downtime Deployment**: Phased rollout without impacting production operations
✅ **Complete Documentation**: Detailed as-built diagrams for support team handoff
✅ **Scalable Design**: Architecture supports future site additions without redesign
✅ **Security Compliance**: Met NERC CIP and pipeline industry security standards
✅ **Cost Optimization**: Leveraged SD-WAN to reduce MPLS circuit costs by 40%
## Professional Context
This project showcases my ability to:
- Design enterprise-grade OT security architectures
- Integrate industrial control systems with modern SD-WAN
- Balance security requirements with operational continuity
- Create documentation for technical handoff to support teams
- Work within regulated industry compliance frameworks (NERC CIP)
The design was fully implemented and is currently operational across all 11 pipeline monitoring sites.
---
**Document Information:**
- **Revision**: v2.0 (R4.4 final)
- **Created**: March 18, 2024
- **Last Updated**: October 31, 2024
- **Company**: JAVOSEC CORP Infrastructure Team
- **Project Code**: SAMPLE-PIPE-001