A single soft FortiToken can be validated by multiple FortiGate VPN gateways only when token authentication is centralized. FortiAuthenticator provides that central OTP/RADIUS service, so both FortiGates query the same token record for the supervisors.

Use segmentation: Network segmentation is critical in an OT environment to isolate different ICS (Industrial Control System) networks and protect sensitive systems. This limits the spread of threats and provides controlled access between segments.
Deploy a FortiGate device within each ICS network: Deploying FortiGate devices in each ICS network ensures that localized security measures are in place to detect and prevent unauthorized access or threats.
Configure firewall policies with industrial protocol sensors: Configuring policies with industrial protocol sensors helps monitor and protect OT-specific traffic (e.g., Modbus, DNP3).
This enables the FortiGate to detect and respond to malicious activities targeting OT protocols.

When a packet arrives, how does FortiGate find a matching policy?
Each policy has match criteria, which you can define using the following objects:
* Incoming Interface
* Outgoing Interface
* Source: IP address, user, internet services
* Destination: IP address or internet services
* Service: IP protocol and port number
* Schedule: Applies during configured times