As an IT manager for a healthcare company, you want to delegate the installation and management of your SD-WAN deployment to a managed security…

The customer's primary goal is to delegate as much installation, administration, and management as possible to the Managed Security Service Provider (MSSP). The most effective way to achieve this is by having the MSSP host and manage the central SD-WAN hub infrastructure.

Options A and C represent the two primary Fortinet blueprints for an MSSP-hosted deployment. Option A uses a shared hub with VDOMs for multi-tenancy, which is a cost-effective solution. Option C provides a dedicated hub at the MSSP premises, offering complete resource isolation and performance guarantees, which may be preferable for a healthcare organization. Both models fulfill the requirement of maximum delegation to the MSSP for both infrastructure and management.

B: Placing a dedicated hub at the customer premises contradicts the goal of delegating infrastructure management and adds unnecessary complexity to the design.

D: This model only delegates remote management via FortiManager. The customer remains responsible for hosting and maintaining the physical hub, which is less delegation than the models in A and C.

1. Fortinet, "Secure SD-WAN for MSSPs 7.0" Solution Guide:

Page 10, "Deployment blueprints": This section explicitly describes the primary MSSP deployment models.

"Shared hub with VDOMs": "In this model, the MSSP hosts a FortiGate hub in their data center and uses VDOMs to provide a logically separate hub for each customer." This directly corresponds to option A.

"Dedicated hub": "In this model, the MSSP hosts a dedicated FortiGate hub in their data center for each customer." This directly corresponds to option C.

"On-premises hub": This section describes the model in option D, noting it's for when the customer hosts the hub, which represents a lower level of delegation compared to the MSSP-hosted models.