Does every branch still need its own firewall?
Alex Pletnev Founder and Managing Director, Inlight ITSome branches can move security inspection into the cloud and retire the local firewall. The decision depends on what else that appliance does and how the branch needs to operate when connectivity fails. An office using cloud applications and a warehouse running local dispatch systems may need different designs, even if they have the same number of staff.
Fortinet’s announcement of 27 October 2026 gives businesses a reason to revisit that decision before their next renewal. Its FortiLink SASE Service connects supported Fortinet wireless access points and Ethernet switches to FortiSASE, allowing traffic inspection and security policy enforcement to happen in the cloud without an on-site FortiGate. It also covers network traffic from devices that cannot run FortiClient, including printers and cameras.
- Teams call in progressBaseline
- Microsoft 365 and cloud financeBaseline
- A new sign-inBaseline
- Printing to the office printerBaseline
- Depends on
- Switches and access points, FortiSASE and the primary connection
- Start with
- Record how each task runs today
Supported switches and access points connect devices and send traffic to FortiSASE for inspection. Record how each task runs today, so the pilot has something to compare against.
What to test depends on the equipment, connectivity and services at each site. See where those services can sit in Fortinet’s thin-edge architecture guide.
Start with the jobs the firewall is doing
A firewall replacement quote tells you what the next appliance costs. To decide whether you need it, you first need to understand its role in that particular branch.
Consider two hypothetical branches.
- Staff use Microsoft 365, a cloud finance system and browser-based customer software
- There are no local servers
- Most work depends on an internet connection
- What it could mean If the local network is straightforward, cloud inspection could allow the business to reduce the equipment it maintains at that office.
- Scanners communicate with local systems
- Printers produce dispatch labels
- Operational devices need to be separated from the office network
- What it could mean The firewall may be involved in several of those functions. Removing it means deciding where each function will run and proving that dispatch can continue under the required conditions.
Even a simple office deserves a closer look at printing, voice, guest access and connections to private applications. The review should establish which traffic stays inside the branch, which traffic leaves it and where the necessary controls are enforced.
Three designs worth comparing
SASE, or Secure Access Service Edge, combines networking with cloud-delivered security. In a thin-edge design, the branch keeps the equipment needed to connect its devices and send traffic to the security service. Inspection happens elsewhere.
Cloud security gives you choices about the equipment at each site. Fortinet documents using an existing FortiGate to forward traffic to FortiSASE, so a supported appliance with useful local responsibilities can remain part of the design.
| Approach | What stays at the branch | Reason to consider it |
|---|---|---|
| 01Local firewall | A firewall alongside the required switching, Wi-Fi and connectivity | Local traffic, network separation or continuity needs favour controls at the site. |
| 02Local equipment with cloud inspection | A suitable router or firewall sends selected traffic to the cloud service | The equipment still has useful routing or local control responsibilities. |
| 03Thin edge | Supported access equipment connects devices to cloud inspection | The branch’s applications and network requirements allow more functions to be delivered remotely. |
| At the branchIn the cloud | ||
Across a mixed estate, different branches may justify different choices. You can standardise how security is managed while choosing equipment that suits the work at each location.
Cloud inspection for small branches is established technology. Fortinet introduced FortiAP integration for microbranches in 2023. The 2026 announcement makes this a useful time to examine the available designs, particularly when equipment replacement or a new office is already in the budget.
Make the outage test part of the decision
Ask the branch manager what work must continue when the internet drops. That answer gives the technical team something concrete to design and test.
At the warehouse, it might mean completing a dispatch already in progress. At the satellite office, it might mean restoring access to cloud applications over a backup connection within an agreed time. Those requirements lead to different tests.
Existing sessions and new connections can depend on different services, so both belong in the test.
Run both tests in the outage panel- Interrupt the primary connectionCheck what happens to an active call, an application session and a print job.
- Start something newTry a new login and connect a device that was previously offline.
- Lose the path to the cloud security serviceEstablish whether traffic stops, uses another protected route or continues without the intended inspection.
Fortinet’s existing thin-edge documentation shows why the details matter. Some designs put address allocation, DNS and the default gateway in FortiSASE. A change in inspection location can therefore also change the services the branch relies on to communicate.
A useful pilot leaves you knowing which work continues, how recovery happens and what staff will experience.
Check the cost of the whole change
Removing a firewall can bring other purchases into the proposal. If the access points or switches need replacing to support the new design, that is a wider network refresh and should be priced accordingly.
- Equipment
- Security subscriptions
- Branch and user licences
- Capacity
- Connectivity
- Deployment
- Ongoing support
Check what is already covered by existing agreements and which charges would be additional.
A supported firewall with useful life
Retaining a supported firewall may make commercial sense where it still has useful life and performs necessary local functions.
Like-for-like at the next renewal
At another site, replacing it may commit the business to equipment and subscriptions that a cloud security design could simplify.
The operational comparison matters too. Work out which deployment, maintenance and troubleshooting tasks change, who will perform them and what the service will cost to run. Central management has value when it makes those responsibilities easier to carry out across the branch estate.
For a FortiLink SASE design, we confirm the supported models, Australian availability and licence terms against your configuration before pricing it.
Let each branch’s work decide its equipment
We would use the next renewal to decide what each type of branch needs, then choose the equipment around that decision. A straightforward office may be a good candidate for a thin-edge pilot. A site with substantial local dependencies may justify keeping its firewall, with cloud security taking on selected functions.
Begin with one representative location whose renewal is coming up
Compare the suitable designs and price the complete change
Test the preferred option against the work that matters there
That gives you a defensible decision for the branch and a design you can assess for similar sites.
Alex sets Inlight IT’s direction and leads its growth and delivery, building on more than 20 years in the technology industry.
Alex Pletnev on LinkedInTalk to us before your next branch renewal
If a branch renewal is coming up, we can work out what needs to stay on site, then design and price the suitable options through our SASE and Zero Trust service.
Review your branch network