One of my clients asked me to check his network. In his server rack I found a Fortinet FortiGate 60 and a Zyxel Zywall 70. Both of them are - in my opinion - complete firewall solutions for SOHOs (which he is with 1 server and about 10 clients).
Since I'm not a network expert, I don't know if this setup can be useful or if it is just redundant.
With an single external connection such a configuration would be highly unusual.
Reasons I can think that why a second firewall could be used for a small group.
Good luck
Two firewalls filtering the same LAN would sound wrong if they were back to back with no other network.
You need to check these firewalls and make a map of the network in order to be able to decide. Only this will give you the information you're looking for.
Only useful if they're run by different groups.
The only situation you'd run into such a setting is if you're at a big organization such as a large financial or government organization.
Could it be that they are running as an Inner and Outer firewall... and then there could be a LAN switch inbetween running a DMZ.
Not how I'd design it nowadays, but some customers insist of two layers of firewalls from different vendors on the Inside/Outside of DMZ.
It's possible that multiple firewall devices could have their LAN sides facing together (i.e. inwards), to provide high isolation for a secure inner LAN core. With one of them providing conventional WAN protection via NAT, the other(s) secure outbound access from LAN-side systems, on a per-port, per-device, or ad-hoc "VLAN" basis.
Because each inside device now sees the 'hard' side of a firewall, this can help prevent the likely and instantaneous cross-contamination of the whole LAN in the case where a LAN connected device is/becomes compromised.
When implemented with inexpensive commodity routers, this arrangement is essentially a cost-effective way to deploy a version of the port security feature only found in high end (i.e. Cisco) routers bearing 5-figure price tags. At one router per port though, costs add up quickly, so this only makes sense for small SOHO or high-end home networks.
Outbound firewall protection is increasingly important these days due to BYOD scenarios as well as a rise in router-targetting malware attacks. Router configuration attacks especially can be radically reduced in the setup described above, by setting the router configuration interfaces to be inaccessible from "outside" their respective firewalls--i.e. not available to the port-connected device.
Without going too far afield, even beyond BYOD, outbound port control is ever more crucial as trust in device-bound software firewalling erodes. Misconfiguration, UPnP port-opening, obfuscating complexity in the firewall UI, "default-allow" outbound policies, silent reconfiguration by installer software, and end-user meddling are long-standing concerns. But now these are compounded, in the latest versions of some operating systems, by hidden ipv6 auto-tunnels (used for telemetry, advertising and marketing functions that sometimes can't be disabled) and/or flagrant OS-privileged firewall bypass modes. Of course software firewalls, being commingled with the device they are supposed to protect, offer dubious security at best, but these new considerations seem to now suggest they're fully pointless. Facing each LAN device to an outwards-facing hardware firewall renders device-bound firewalls and their myriad problems moot.
