Hosted Firewall & Network Security

Yes. Read-only visibility is available on request through Sophos Central or a read-only FortiManager ADOM profile. Write access to production is an exception that needs explicit approval, because it changes the managed-service operating model.

No. FortiAnalyzer Cloud is Fortinet's own service, typically hosted in US or EU regions and billed in dollars. FirstNet's service is hosted in South Africa, billed in rands and operated by FirstNet, so log data stays in South Africa during normal operation.

No. It is the Fortinet-native analytics and reporting layer, sitting closer to your FortiGates and providing out-of-the-box compliance reports. If you already use Splunk or Sentinel, keep it; log forwarding to your SIEM can be scoped separately.

Production FortiManager runs as an HA pair with daily configuration backups and a documented recovery runbook. Your FortiGates keep enforcing policy locally during a management-plane outage, so traffic is not dropped.

You retain ownership of your data and configurations. FirstNet supports an agreed handover and deprovisioning process, and FortiAnalyzer logs are exportable on exit. Migration work outside the standard service is scoped separately.

Firewall as a service is a managed firewall service: instead of buying and running the firewall platform yourself, FirstNet provides, configures and supports it for you. FirstNet handles firewall policy, updates, monitoring, change management and incident response within the agreed scope. You can choose a dedicated firewall at your own site or a firewall hosted on FirstNet's platform. FirstNet offers FWaaS on both Fortinet and Sophos technology, and support is available in 8x5 or 24x7 options.

An on-site firewall suits organisations with data sovereignty or latency requirements, local internet breakout, or high WAN throughput, because the appliance sits on your premises. A hosted firewall suits organisations that want managed protection without owning or maintaining an appliance, prefer a monthly operating expense, or are rolling out many sites where a centrally hosted service is simpler to operate. FirstNet manages both options, and the right choice is usually confirmed in a short discovery session covering sites, users, links and VPN needs.

Hosted VDOM Lite is for simpler needs: basic firewalling, NAT, routing and VPN. Hosted VDOM Enterprise adds advanced security and networking, including unified threat management features such as intrusion prevention, antivirus, web filtering and application control, plus SSL inspection and SD-WAN where required. Both are hosted firewall services run by FirstNet on its FortiGate platform. If you need a dedicated firewall with more customer-specific design flexibility, FirstNet's On Prem FWaaS track places a FortiGate at your site instead.

Standard Protection covers core firewall needs: firewalling, NAT, routing, site-to-site and remote-access VPN, intrusion prevention, web protection, application control, TLS inspection and Sophos X-Ops threat intelligence. Xstream Protection adds zero-day protection through sandboxing and machine-learning file analysis, SD-WAN orchestration, DNS Protection, NDR Essentials and advanced reporting with 30-day cloud log retention. Both bundles are available whether your Sophos firewall sits on site or is hosted by FirstNet, so the choice depends on your security needs rather than where the firewall lives.

A firewall should be sized on your real peak inspected traffic, not on your internet line speed. Sizing considers total and concurrent users, the number of devices (including BYOD, IoT and servers), peak throughput, which security features will be enabled, and how much traffic needs SSL/TLS inspection, which is often the biggest sizing factor. VPN tunnels and remote users, concurrent sessions, interface requirements, high availability and expected growth over the next 12 to 36 months also affect which model is right.

Synchronized Security lets a Sophos firewall and Sophos endpoint protection (Intercept X) share information automatically. Through Security Heartbeat, each device reports a real-time health status, and the firewall can automatically isolate a compromised device from the network. It is included when you run a Sophos firewall alongside another Sophos product. You can keep a different endpoint vendor and the Sophos firewall will still protect you, but this automatic firewall-to-endpoint response only works with Sophos endpoints.

FirstNet manages the firewall itself: configuration, policy, firmware and signature updates, monitoring, approved changes and incident response within the contracted scope. You remain responsible for your internal LAN, endpoints, cabling, ISP handoffs and applications unless these are separately agreed, and for providing accurate inputs such as rules, VPN peer details and certificates. Onsite hands-and-feet support is not part of the standard service. Full network redesigns, security audits and penetration testing are scoped separately.

With Standard Protection, logs are kept on the firewall for seven days with basic reporting in Sophos Central. Xstream Protection adds Central Firewall Reporting Advanced, with 30-day cloud log retention and multi-firewall reporting. If you need longer retention, logs can be retained through Sophos MDR's data lake or forwarded to a SIEM you manage via syslog. The retention approach and any integration are confirmed during the design phase.

FAZaaS is FirstNet's managed FortiAnalyzer service for centralised log analytics, compliance reporting, threat correlation and incident investigation across your Fortinet devices. FirstNet runs a dedicated FortiAnalyzer-VM instance for you on FirstNet-operated infrastructure in South Africa and handles patching, upgrades, backups, capacity monitoring and routine platform operations. You pay a monthly service in rand based on a storage bundle, so there is no hardware to buy, no virtual machine to run and no Fortinet licence to manage yourself.

FAZaaS is sold in storage bundles starting at 50 GB and increasing in 50 GB steps. As a rule of thumb, 100 GB holds about 90 days of logs at 1 GB per day, measured before compression. A small office with one to three FortiGates and little SSL inspection typically fits 50 GB, while larger estates with active SSL inspection or retention beyond 90 days need more. FirstNet sizes the bundle from your device count, daily log volume and retention needs, and recommends sizing up if your estate is growing.

Your storage bundle is a hard ceiling, but FirstNet monitors ingestion trends and alerts you before you reach it so the bundle can be stepped up. There are no silent overage charges. It is important to act on these alerts, because logs above the ceiling are not stored. Log volume can also change quickly, for example if full SSL deep inspection is switched on mid-contract, so FirstNet recommends re-baselining log volume after about six months.

With FAZaaS, log data is held on FirstNet-operated infrastructure in South Africa and, under normal service operation, remains within that South African hosting footprint. FirstNet carries the operational responsibility for the hosted platform, but your organisation remains the responsible party under POPIA, so your obligations to data subjects and your internal governance stay unchanged. This positioning applies to FAZaaS specifically. If you buy FortiAnalyzer Cloud directly from Fortinet, it is typically hosted in US or EU regions.