FortiWiFi 60D questions

emnoc wrote:

Sorry you can't operate integral radio on 2.4 & 5ghz. You can buy a dedicated AP that's dual radio and operate it on 5ghz if so desired.

Thanks for the information. Additional APs are not an option at the moment so we'll have to live with single band for now.

ede_pfau wrote:

a) ALL FortiWiFi do only have 1 radio (module). IMHO this doesn't have to do with the cost of the unit or it's quality; it's a design decision.

Good to know. It's still a bit strange that they couldn't stretch to two radios on these units.

I can recommend the FortiAPs which are powerful, have bigger antennas and are fully integrated into ANY Fortigate (for free, if that counts).

Unfortunately additional APs are out of the question, which means we will have to live with single band for now.

b) the 60D is passively cooled, i.e. without a fan. Just be careful not to throw the FGT around as the cooling sink might rip off and the SoC might die by heat.

Hm, that doesn't really instill confidence in the hardware quality of the 60D. Something like that should not happen in a $400 or so device.

c) there have been 4 revisions to the 60D model over time. The latest, the greatest - 2 GB RAM. Hardware revisions are not documented to the public, for obvious reasons. You might have a look at this post: FGT platforms with CPU, memory and supported firmware

Thanks for the link. Are you sure the revisions are for the 60D? The page shows the 60C having four revisions, and only one for the 60D (ok, two if you count the POE version).

d) just a heads up: the 80C is quite powerful if you use a lot of AV, IPS, AppControl at the same time, due to it's powerful CPU. The 60D is built upon a SoC2 (system-on-chip) which combines a RISC core with a Fortinet NPlite ASIC on one chip. As such, pure firewall throughput is way higher than that of the 80C but AV is...10% of that. Have a good look at the datasheets.

Same with SSL VPN. If you foresee a high usage of SSL VPN then you should consider a 'real CPU' model, like the 80D, 100D, 92D (this from hearsay, ask Selective).

Both units should be fine, our requirements in terms of throughput are quite low (one 40/8Mbps connection, mostly less than 10 users), so based on the datasheets the 60D should be fine.

The most annoying thing with our 80C is the fan, which can be quite disturbing. The other thing is that this is a Rev 1 unit with only 512MB of memory, and while it hasn't hit conserve mode so far the memory utilization is usually over 80%.

emnoc wrote:

ALL FortiWiFi do only have 1 radio (module).

 

Yes correct, but some will interpet it wrong. They have 2 band and 1 radios but can't operate on both bands at the same time. Only some  AP have  dual radios and can operate on both bands at the same time.

Well, in my opinion FortiNet doesn't do much to highlight this. From the 60D datasheet http://www.fortinet.com/sites/default/files/productdatasheets/FortiGate-60D.pdf:

In my opinion this creates the impression that simultaneous 2.4GHz/5GHz operation is possible, especially when nowhere is stated that its not.

If your FWF80 is working good, I would not downgrade it especially since you  have a MIMO 2x3 vrs 2x2 for the FWF60D. I was also told it's the same  radio in both platforms, so with the FWF80 having a slightly better cpu, you should just keep it unless you need more 1GIGE interfaces.

Aside from the WiFi (with which we could live if necessary) there's still the fan and the low RAM. And especially the fan is a major issue.

Dave Hall wrote:

Regarding your existing 80C, I recall someone mentioning on the forums about the fan suppose to have a controllable speed setting, but either is faulty or just "stuck" on high....supposedly it was fixed in v2 though.

Interesting. I noticed that the fan is controlled (it shortly goes to full speed after power up, and then sits what I guess is around 75%).

(Someone want to follow up/correct me on this?)

I did a short search but didn't find anything, so if someone has more details please chime in!

I suggest contacting your local Fortinet sales rep (dealer) if you are still considering purchasing a new Fortigate -- they should be able provide you with a test/demo unit for evaluation purposes.

That is an option, but before I approach a reseller I'd like to check some basics to make sure it's worth going that route.

Personally, as emnoc suggests, I would stick with the 80C and just purchase an AP that supports dual radio.  If the 80C is running into memory issues, check out KB #FD35127.

Thanks for the link. We did most of it already, and while the box hasn't yet gone into conserve mode memory consumption is generally high. I guess 512MB just isn't cutting it any more.

Danke für die Ausführungen!

ede_pfau wrote:

I totally get your point with the fan noise. I love the 80C when it's housed in a rack, or at least some sideboard. Apart from the high pitched noise there is very little that makes a 80C obsolete even today.

The funny thing is that the main purpose of the fan seems to make a whining noise, as its airflow is patheticly low, and there is nothing visible in its air path that requires cooling. The major heat source in this thing is the CPU and the NP, and the latter is completely off the fan's air path (and the low air flow will only have a neglegible effect on the CPU temperature).

I'm sure the 80C would work just fine without the fan.

So the major drawback is the limited memory. Fortunately, FTN has been lavish with recent models, even with the small desktop ones, so that 2 GB is standard nowadays. If you had the rev. 2 80C you could well live with it's 1 GB, even running v5.2.2.

Conserve mode kicks in if the memory consumption grows beyond 80% - which is bad and should be avoided altogether. In conserve mode AV scanning is bypassed (and some other features as well) so the protection level goes down.

The device was used as a firewall only (no UTM subscriptions), and even when memory consumption is high I haven't seen running ito conserve mode. However, to test I now activated the UTM trials on that device, and and now it hits conserve mode frequenclty according to the log. I tried some of the tricks mentioned in the KB (like disabling memory logging) but that barely makes a difference. It does help disabling some of the services but even then it does hit conserve mode occasionally.

Maybe 5.2.2 is just not suitable for 512MB devices. I don't want to go back to 4.0, though. I wonder if 5.0.9 is a better choice for that box, though.

My hint at the 60D's heatsink should not deter you from using one. It's just that it happened in the past, and without proper cooling the CPU will be overheated soon. I've got a couple of 60Ds out with customers and have yet to see one single failure. It's quite responsive, got ample ressources and it's the only model with a lot of hardware variants (PoE, WiFi, SFPs).

Well, the 60D does look quite attractive, especially with its high firewall performance. And 2GB RAM should be sufficient for a long time (and many FortiOS releases). I did notice the SFP variants, which would be a bonus. It's a shame that there's no FortiWiFi 60D with SFP, though.

You will enjoy lower contract fees as well.

Yes, I noticed that. The 60D subscriptions seem to be a lot lower than for the 80C.

You're right, I might have confused the HW revisions of 60C and 60D, sorry. With the all new 70D, 80D, 90D and siblings it's more than unlikely that the lower models will see a significant HW revision in the future (IMO).

That's probably true. And I guess since memory is cheap these days it's probably easier now for FortiNet to put sufficient memory in their boxes. It's just a shame that the memory in the 80C seems to be soldered on and not in module form, otherwise expansion would be an option.

So I guess I'll have to keep an eye out for a good deal on a FWF-60D then.

Thanks for the help!