Fortinet PSE Playbook
The sale is a promise, and Professional Services keeps it. A Fortinet Professional Services Engineer (PSE) turns the design that was sold into a system that runs. That means design documents, deployment, migration off the old vendor, a cutover without surprises, and a handover the customer’s team can own. This playbook covers what the role delivers, how it creates value, and how the delivery changes across Fortinet’s market segments.
What the Professional Services Engineer actually does
Design it
- Design documents: high-level and low-level designs, test plans, and step-by-step cutover procedures
- Validation: prove the design in a lab or pilot site before it touches production
- Design authority: one owner who tracks and resolves issues through the whole project
Deliver it
- Deployment and migration: installation, configuration, and replacement of the outgoing vendor in production
- Cutover: inside an approved window, with a tested rollback plan
- Acceptance testing: confirm the system does what the customer was promised
Hand it over and improve it
- As-built documentation: a record of what was actually built, owned by the customer
- Knowledge transfer: training the team that has to run it on Monday
- Health checks and tuning: keeping the deployment sound as the business changes
Bought is not the same as deployed
The customer signed because the design promised consolidation, better protection, and lower cost. None of that exists until the equipment is installed, the old vendor’s rules are moved over, and the traffic cuts over without an outage. A small team that already runs the business all day rarely has the hours or the Fortinet depth to do that safely. Projects stall, licenses run while hardware sits in boxes, and the first bad cutover becomes the story the customer tells about Fortinet.
Fortinet Professional Services across the whole life of the deployment
Design and transition
- Design Workshop and Network Design and Integration: turning the sold architecture into high-level and low-level designs
- Design and Configuration Validation: customer-specific test plans that prove the design before production
- Technical Design Authority: one design lead who tracks and resolves issues through the whole project
Deploy and migrate
- QuickStart services: packaged FortiGate, SD-WAN, FortiNAC, and FortiSOAR deployments
- Firewall Migration and Replacement: production-to-production moves off a third-party vendor
- Software Upgrade and Platform Migration: firmware upgrades and hardware refreshes planned and executed
Operate and optimize
- FortiGate Health Check and Security Hardening: operational review, tuning, and hardening for the platform and firmware in use
- Compliance Audit Preparation: configuration baselines and written guidance for audits such as PCI and HIPAA
- Designated engineer and custom training: ongoing expertise and training on the design that was actually deployed
How the Professional Services Engineer proves it: join the Sales Engineer before the deal closes so the design is buildable, write the low-level design and the cutover procedure, validate both in a lab or a pilot site, then run the cutover with a tested rollback plan. Hand over as-built documentation and train the team that will run it.
What it looks like on the ground
The issue
Two data center firewalls from another vendor held 4,000 rules built up over a decade, and nobody wanted to own the cutover in a hospital that never closes.
The Fortinet fix
A Firewall Migration and Replacement project: rules converted, unused and shadowed rules removed, the design validated against a test plan, and the cutover run in two maintenance windows with a rollback ready.
The outcome
Rule count cut by more than half, no clinical downtime, and an as-built document the team actually uses.
The issue
SD-WAN was bought to retire MPLS, but the two-person network team could deploy only a few branches a month alongside their regular work.
The Fortinet fix
An SD-WAN QuickStart to build and test the standard branch design, then a repeatable rollout with zero-touch provisioning and a checklist the team followed for the remaining sites.
The outcome
All branches live in one quarter, and MPLS contracts cancelled on schedule.
The issue
FortiGates installed three years earlier by a departed contractor, an audit coming in two months, and no current documentation.
The Fortinet fix
A FortiGate Health Check and Security Hardening review, a firmware upgrade plan, and compliance audit preparation with a configuration baseline.
The outcome
Findings fixed before the auditors arrived, and documentation the county now owns.
Example organizations are fictional composites, not customers.
Value starts at go-live, so get there sooner
The head-to-head comparison, honestly told
| Alternative | Their pitch | Where it breaks down | The Fortinet edge |
|---|---|---|---|
| The customer’s own team | “We’ll install it ourselves” | Works for small sites, but large migrations compete with daily work and stall, and Fortinet depth is thin on a team that just switched vendors | Engineers who deploy Fortinet every week, then train the team to run it |
| A reseller or integrator alone | One partner for hardware and labor | Many partners do excellent work, but depth on newer products such as FortiSASE or FortiSOAR varies from partner to partner | Fortinet engineers working alongside the partner, not replacing them |
| Professional services from the outgoing vendor | “We know your current setup” | They know the old system, but they are not the ones building the new one | Migration expertise from the vendor you are moving to |
How the Professional Services Engineer works
- Get involved before the deal closes. A design that looks good on a whiteboard still has to be built.
- Write it down. High-level and low-level designs, test plans, and cutover procedures are what make the work repeatable.
- Never cut over without a rollback plan, and never surprise the customer with a change they did not approve.
- Leave the customer able to run it. Knowledge transfer is part of the deliverable, not an extra.
The same services, delivered differently in every market
A Professional Services Engineer uses the same Fortinet services everywhere, but what the customer needs on delivery day changes with the segment. A small business needs speed, a plant needs zero risk to production, and a global enterprise needs every region to build the same thing.
What delivery looks like in each segment
| Segment | What the customer needs at delivery | How the Professional Services Engineer delivers it |
|---|---|---|
| SMB / Broad | A working network quickly, with no in-house security staff | A QuickStart deployment of the FortiGate and SD-WAN from a standard design, done with the partner and handed over with as-built documentation that a two-person IT team or their provider can maintain. |
| Mid-Market / Commercial | Off the old firewall vendor without overloading a small team | A firewall migration off the outgoing vendor with rules cleaned up and tested before cutover, SD-WAN rolled out site by site, and a FortiGate health check after the first months in production. |
| Named Enterprise | Proof the design works before each migration wave | Design and configuration validation against a customer-specific test plan, then a phased migration from the incumbent vendors with one design lead tracking issues across every wave. |
| Major Enterprise | A repeatable way to bring every acquired network up to standard | A designated engineer working inside the account, a standard configuration validated in the lab, and a repeatable cutover method for every acquired network. |
| Global Enterprise | One design deployed the same way by many regional teams | A technical design authority who keeps the global reference design consistent while regional teams deploy it, with software upgrades and platform migrations planned across regions. |
| OT / Critical Infrastructure | No change that puts a running production line at risk | Lab testing and validation before any change reaches the plant, cutovers scheduled inside the plant’s maintenance windows, and security hardening matched to the rugged platform and firmware. |
| Service Provider / MSSP | A service the provider’s own engineers can run and resell | The reference architecture built and validated in the provider’s lab, custom training on the deployed design for the provider’s engineers, and a dedicated engineer through the first customer launches. |
| Public Sector | An audit-ready configuration on a fixed budget and timeline | Compliance audit preparation with configuration baselines, a deployment timed to the funding window, and custom training so a small IT team can run what was installed. |
What stays the same in every segment
- Find out what went wrong on the last project before planning this one.
- Validate the design in a lab or pilot site before it touches production.
- Cut over with a tested rollback plan and the customer’s approval.
- Leave as-built documentation and a team trained to run what was installed.