Fortinet PSE Playbook
The sale is a promise, and Professional Services keeps it. A Fortinet Professional Services Engineer (PSE) turns the design that was sold into a system that runs: design documents, deployment, migration off the old vendor, a cutover without surprises, and a handover the customer’s team can own. That has been most of my career. I start every project by finding out what went wrong last time, so it does not happen again.
What the role delivers, from design to go-live
Bought is not the same as deployed
The customer signed because the design promised consolidation, better protection, and lower cost. None of that exists until the equipment is installed, the old vendor’s rules are moved over, and the traffic cuts over without an outage. A small team that already runs the business all day rarely has the hours or the Fortinet depth to do that safely. Projects stall, licenses run while hardware sits in boxes, and the first bad cutover becomes the story the customer tells about Fortinet.
Fortinet Professional Services across the whole life of the deployment2
Design and transition
- Design Workshop and Network Design and Integration: turning the sold architecture into high-level and low-level designs
- Design and Configuration Validation: customer-specific test plans that prove the design before production
- Technical Design Authority: one design lead who tracks and resolves issues through the whole project
Deploy and migrate
- QuickStart services: packaged FortiGate, SD-WAN, FortiNAC, and FortiSOAR deployments
- Firewall Migration and Replacement: production-to-production moves off a third-party vendor
- Software Upgrade and Platform Migration: firmware upgrades and hardware refreshes planned and executed
Operate and optimize
- FortiGate Health Check and Security Hardening: operational review, tuning, and hardening for the platform and firmware in use
- Compliance Audit Preparation: configuration baselines and written guidance for audits such as PCI and HIPAA
- Designated engineer and custom training: ongoing expertise and training on the design that was actually deployed
How the Professional Services Engineer proves it: join the Sales Engineer before the deal closes so the design is buildable, write the low-level design and the cutover procedure, validate both in a lab or a pilot site, then run the cutover with a tested rollback plan. Hand over as-built documentation and train the team that will run it.
What it looks like on the ground
The issue
Two data center firewalls from another vendor held 4,000 rules built up over a decade, and nobody wanted to own the cutover in a hospital that never closes.
The Fortinet fix
A Firewall Migration and Replacement project: rules converted, unused and shadowed rules removed, the design validated against a test plan, and the cutover run in two maintenance windows with a rollback ready.
The outcome
Rule count cut by more than half, no clinical downtime, and an as-built document the team actually uses.
The issue
SD-WAN was bought to retire MPLS, but the two-person network team could deploy only a few branches a month alongside their regular work.
The Fortinet fix
An SD-WAN QuickStart to build and test the standard branch design, then a repeatable rollout with zero-touch provisioning and a checklist the team followed for the remaining sites.
The outcome
All branches live in one quarter, and MPLS contracts cancelled on schedule.
The issue
FortiGates installed three years earlier by a departed contractor, an audit coming in two months, and no current documentation.
The Fortinet fix
A FortiGate Health Check and Security Hardening review, a firmware upgrade plan, and compliance audit preparation with a configuration baseline.
The outcome
Findings fixed before the auditors arrived, and documentation the county now owns.
Example organizations are fictional composites, not customers.
Value starts at go-live, so get there sooner
The head-to-head comparison, honestly told
| Alternative | Their pitch | Where it breaks down | The Fortinet edge |
|---|---|---|---|
| The customer’s own team | “We’ll install it ourselves” | Works for small sites, but large migrations compete with daily work and stall, and Fortinet depth is thin on a team that just switched vendors | Engineers who deploy Fortinet every week, then train the team to run it |
| A reseller or integrator alone | One partner for hardware and labor | Many partners do excellent work, but depth on newer products such as FortiSASE or FortiSOAR varies from partner to partner | Fortinet engineers working alongside the partner, not replacing them |
| Professional services from the outgoing vendor | “We know your current setup” | They know the old system, but they are not the ones building the new one | Migration expertise from the vendor you are moving to |
How the Professional Services Engineer works
- Get involved before the deal closes. A design that looks good on a whiteboard still has to be built.
- Write it down. High-level and low-level designs, test plans, and cutover procedures are what make the work repeatable.
- Never cut over without a rollback plan, and never surprise the customer with a change they did not approve.
- Leave the customer able to run it. Knowledge transfer is part of the deliverable, not an extra.
The same services, delivered differently in every market
The services are the same everywhere, but delivery day changes with the segment. A small business needs speed, a plant needs zero risk to production, and a global enterprise needs every region to build the same thing.
What delivery looks like in each segment
| Segment | What the customer needs at delivery | How the Professional Services Engineer delivers it |
|---|---|---|
| SMB / Broad | A working network quickly, with no in-house security staff | A QuickStart deployment from a standard design, done with the partner, with as-built documentation a two-person IT team can maintain. |
| Mid-Market / Commercial | Off the old firewall vendor without overloading a small team | A firewall migration with rules cleaned up and tested before cutover, SD-WAN site by site, and a health check after the first months. |
| Named Enterprise | Proof the design works before each migration wave | Validation against a customer-specific test plan, then a phased migration with one design lead tracking issues across every wave. |
| Major Enterprise | A repeatable way to bring every acquired network up to standard | A designated engineer inside the account, a lab-validated standard configuration, and one cutover method for every acquisition. |
| Global Enterprise | One design deployed the same way by many regional teams | A technical design authority who keeps the global design consistent while regional teams deploy it, with upgrades planned across regions. |
| OT / Critical Infrastructure | No change that puts a running production line at risk | Lab validation before any change reaches the plant, cutovers inside maintenance windows, and hardening matched to the rugged platform. |
| Service Provider / MSSP | A service the provider’s own engineers can run and resell | The reference architecture validated in the provider’s lab, training for the provider’s engineers, and a dedicated engineer through the first launches. |
| Public Sector | An audit-ready configuration on a fixed budget and timeline | Audit preparation with configuration baselines, a deployment timed to the funding window, and training for a small IT team. |
What stays the same in every segment
- Find out what went wrong on the last project before planning this one.
- Validate the design in a lab or pilot site before it touches production.
- Cut over with a tested rollback plan and the customer’s approval.
- Leave as-built documentation and a team trained to run what was installed.
Talk to me about the Professional Services Engineer role
I can walk through a deployment, a migration, or a handover from this playbook in more detail, or work through a project of your choosing.
Sources and notes
- Estimate. Field estimate for large legacy rule bases built up over years. No survey source.
- Fortinet. Professional Services. 2026. Fortinet’s catalog names include Design Workshop Service, Network Design and Integration, Design and Configuration Validation, Technical Design Authority and Implementation, Firewall Migration and Replacement Project, Software Upgrade and Platform Migration Project, FortiGate Health Check, Security Hardening, Compliancy Audit Preparation, Designated Engineer Services, Custom Training on Deployed Solution, and QuickStart services for FortiGate NGFW, SD-WAN, FortiNAC, and FortiSOAR. This page shortens some of these names.