I'm just looking for advice/best practices on how to properly segment my network with the goal of it being as secure as possible, but also easy to manage.
Currently, the network is flat and almost internal PCs, servers etc are on the same subnet, with the exception of a DMZ for all internet facing servers. I have a FortiGate 80c and two 3Comm Managed switches. I want to separate all production servers, IT personal, and the rest of staff.
My main question is should I try to manage it all through my router, and break the "Internal Ports" (6 of them) on my Fortigate, so I can have a few different internal interfaces? This way, I could easily subnet each network group (sales, IT, production servers) and then have policies enforcing which network can see what. Basically, create a few DMZ type setups. I'd have a switch for each group, and plug each switch into the corresponding internal port on the Forigate.
Alternatively, I could create VLANs in my switches, and then have my Fortigate separate the VLANs into different subnets.
I suppose I'm hesitant to do option 2 because it seems like a lot of work (I'm not familiar with the managed switches setup) and then I'd have to worry about managing switches in addition to the FortiGate.
Any input or advice would be much appreciated!