FortiGate deployments and migrations
New FortiGate installs, HA pairs and like-for-like replacements, plus migrations from Cisco ASA, SonicWall, Sophos, Meraki and others, with a written cutover and rollback plan. See firewall migration.
Fortinet Professional Services · Staff Augmentation
Fortinet professional services
and contract network engineering.
Senior Fortinet and network engineering for a defined project, a monthly retainer or on-site staff augmentation. On site across the San Francisco Bay Area and the Sacramento region.
What We Take On
Fortinet consulting and network engineering work.
The projects IT teams most often bring to an outside Fortinet consultant.
SD-WAN and multi-site VPN
Fortinet SD-WAN design, performance rules for voice and SaaS, hub-and-spoke or mesh VPN, and the cutover of each site. See SD-WAN migration.
FortiManager and FortiAnalyzer
Central management for a fleet: device onboarding, policy packages, templates, firmware waves and log retention that matches your audit requirements.
ZTNA and remote access
Migration from SSL-VPN to IPsec VPN or ZTNA; ZTNA adds identity-based access to individual applications. See ZTNA and VPN replacement.
Switching and Wi-Fi
FortiSwitch and FortiAP managed from the FortiGate, VLAN design and segmentation, and work on the Cisco, Aruba and Arista gear you already run.
Audits, upgrades and documentation
Firewall policy cleanup, firmware upgrade planning, configuration reviews and as-built documentation your team can maintain. See network audit and documentation.
Engagement Models
Four ways to bring us in.
Start with the one that fits the work. Engagements can move between models as the work changes.
01 · Project
Defined projects
A migration, a new site or a FortiManager rollout with a clear end. Scoped in writing and delivered for a fixed fee, with the cutover plan, rollback steps and documentation included.
02 · Hourly
Engineering by the hour
Remote engineering for configuration changes, troubleshooting and design work, billed by the hour. Rates are in the FAQ below.
03 · Retainer
Fractional network engineer
A monthly engineering allowance for change work, troubleshooting and design review. See retainers.
04 · On site
Staff augmentation
On-site engineering for refresh projects, cutovers or temporary vacancy coverage. Partner-delivered staff augmentation has a five-day minimum commitment and is quoted after scoping.
Coverage
On site in the Bay Area and Sacramento. Remote anywhere.
San Francisco Bay Area
San Francisco, the North Bay, the Peninsula, the East Bay, the South Bay and San Jose. Field work is delivered with a vetted field partner under our statement of work and change process.
Sacramento region
Sacramento and the surrounding region, on site or remote. See Sacramento network engineer.
Remote engineering
Configuration, troubleshooting and design work delivered remotely, in your maintenance windows, wherever your team operates.
One senior network engineer is your point of contact for the whole engagement, whoever is on site.
How We Work
Written scope, controlled changes, full handover.
Scope in writing
Every engagement starts with a statement of work: what is in scope, what is not, who approves changes and how extra work is handled.
Change records and rollback
Production changes go through a written change record with a tested rollback, and run in an agreed maintenance window.
Documentation you keep
Configurations, diagrams and runbooks are handed over at the end, so your team or the next engineer can carry on without us.
Procurement-ready: W-9, MSA, statement of work, mutual NDA and security questionnaires on request.
Engineering Background
Enterprise network engineering, applied to your project.
Our engineering background spans more than 20 years and more than 300 sites: multi-site WANs, campus and data center networks, and production infrastructure for hyperscale AI research. Work is led by our principal engineer, Jeff Johnson (ex-Meta; Cisco and Fortinet certified). Ambio is a Fortinet Engage partner. See how an engagement runs, week by week. Figures are a career aggregate, including prior-employer engagements.
Best Fit
Who this is for.
✓ Good Fit
- IT teams with a Fortinet estate that need senior depth for a project or a gap
- Organizations with several sites moving to SD-WAN or central FortiManager management
- MSPs and IT providers that need a Fortinet engineering bench behind them
- Companies covering a network engineer vacancy while they hire
× Not a Fit
- Help desk, laptops or Microsoft 365 support
- Permanent placement or recruiting of full-time hires
- Hardware-only orders with no engineering (see the FortiGate catalog)
Related
Need ongoing coverage instead?
FAQ
Questions about contract Fortinet engineering.
What do Fortinet professional services cost?
Remote engineering is $225 an hour, and $325 an hour for specialized Fortinet work such as ZTNA, FortiManager and multi-site cutovers; prepaid blocks of 20 hours or more reduce the standard rate. Defined projects are a fixed fee in a written statement of work. Monthly retainers start at $1,720. On-site staff augmentation is quoted after scoping, because the rate depends on the length of the engagement and the dates.
Can you put a network engineer on site?
Yes. We put an engineer on site across the San Francisco Bay Area, including the Peninsula, the East Bay and San Jose, and in the Sacramento region. Bay Area staff augmentation is booked by the week, with a five-day minimum; shorter on-site visits are available in the Sacramento region. You keep one point of contact for the whole engagement.
Is this the same as Fortinet's own professional services?
No. Fortinet sells its own professional services. We are an independent firm and a Fortinet Engage partner: we scope the work, own delivery under one statement of work, and open Fortinet support cases when a problem needs the vendor.
Will you work alongside our IT team or our MSP?
Yes. We work alongside internal IT teams and MSPs, with responsibilities, change approvals and escalation paths agreed before work starts.
Do you only work on Fortinet?
No. Our deepest expertise is in Fortinet and Cisco. We also work on Aruba, Arista, Meraki and SonicWall networks and scope migrations when needed.
Should we hire a network engineer instead?
A permanent hire suits a sustained full-time workload. Contract engineering suits a defined project, temporary vacancy coverage or specialist work that does not need a full-time role. Everything we do is documented, so a future hire can pick it up.
Start an Engagement
Tell us about the project.
Send your project scope, target dates and current network equipment.
What Happens Next
Response from a senior engineer within 1 business day.
A written estimate before any work starts.