Hi @PavelK
That's a tough one. So ...
Wherever possible I would use VM series firewalls for the segmentation. You simply have more flexibility with the sw based approach than with hw. In case you need more throughput you simply extend the HA to a HA cluster with up to 16 nodes per cluster. Of course if you need 100G throughput for single sessions, then there is no other option than the big HW firewalls from paloalto.
For a recommendation for the rest of the situation I would need some more information. As there are quite a few locations with different MPLS lines, I assume there is no additional internet access at these locations and all traffic including internet traffic needs to go to HQ. This makes it easier as you have less firewalls to control. Also here it really depends on the security requirements of the company. From routing all locations together up to separate even different subnets at these locations there are more than one recommended setups - it all depends on the budget and the security requirements.
Regarding the different business units: if there are such different units I would make sure that their systems are located behind dedicated firewalls so unit a will not have access to unit b. In order to keep at least some control I would recommend to use panorama with pre rules and the units only have access to post rules or only rules local on the firewall. With that you at least have aome control with a company policy.
At least on prem I would go the "old" way with the network segmentation and not do micro segmentation as I think in a lot of cases there is no need to have everything sent over a firewall. Of course it is also for blocking connection as near as possible to the source systems but this can be done easily with the host firewalls or with Cortex XDR which has even way more advantages regarding the security standard in your network.
With more informations about the requirements the answer might be better if you ask the live community but this can be time-intense for the ones that reply to queations here - but we are all in this together and happy if we can help. I hope you are not disappointed with the answer.
Cherrs,
Remo
... View more
