How to Suggest Fortigate to customer

Question

I would like to ask that how we suggest fortigate to customer ,  For example we have 500 user so how we will check which device is best and what will be through output will be better for it

Iescudero · Accepted Answer

Hi There!

The answer is a little bit tricky, because a single user could generate a lot of sessions and another just a few.

Other case would include if you have a service exposed to internet, like a website, so you want to use a IPS, or in the other hand you just use the Fortigate like a Router to Internet. that's why the answer depends on several things, not just the amount of users.

In my experience with around 500 users i got this status:

CPU states: 77% user 42% system 0% nice 51% idle CPU0 states: 77% user 42% system 0% nice 51% idle Memory states: 54% used Average network usage: 40936 kbps in 1 minute, 44003 kbps in 10 minutes, 37604 k bps in 30 minutes Average sessions: 28504 sessions in 1 minute, 29806 sessions in 10 minutes, 2943 4 sessions in 30 minutes Average session setup rate: 192 sessions per second in last 1 minute, 186 sessio ns per second in last 10 minutes, 183 sessions per second in last 30 minutes Virus caught: 0 total in 1 minute IPS attacks blocked: 0 total in 1 minute Uptime: 104 days, 13 hours, 4 minutes

This is from two Fortigate 110C in a HA configuration with IPS, Antivirus, Web Filter, Application Control and a lot of IPSec VPN's. and FortiOS 5.2.10

The cluster is not responding very quickly sometimes or the CPU have spikes 100%, so taking this as a example I am short of resources, but I think a 200 would probably fit for me.

The list below just reflect my opinion:

500-1000 users = Fortigate 300D

250-500 users = Fortigate 200E

100-250 users = Fortigate 100E

Around 100 users = Fortigate 90E

50-100 Users= Fortigate 60E

1-50 Users = Fortigate 50E/Fortigate 30E

in my opinion, a Fortigate 200E would be great for 500 users and a few features enabled on it.

Hope it helps!

ChrisRX · Answer

Budget is a huge topic to debate when selecting the right Firewall. What's the end goal for this network? Also, if this company is growing then I highly recommend you take this into account. I currently have two 600C Fortigates for a company with about 230 employees, and about triple that in devices. They're setup in Active-Active for HA. Now, as I'm sure you're aware as you move up in each Fortigate Models, the more expensive they become,however the more features you will get with the main advantage of obtaining some crazy throughput. In my opinion after working with Fortigates for over 6 years now, I would consider what security features you will need first, then build from there.

As a side note. I've ran a 200 user office off two 100D Firewalls without complaints. However, it was only servicing Internet with web filtering at first. I then downgraded an older Layer 3 HP switch to Layer 2 Access, and had the 100D route. Made a huge difference in performance believe it or not. The ASIC Chips in the Fortigates really do a nice job with offloading now, at first there were some weird anomalies, but those bugs were squashed with firmware updates. We saw better throughput to our CoLo to end user without the units exhausting their resource limits. And, with all with the added benefits of Application, Device, and User discovery to make managing Policies, Users, and Device Groups much simpler.

Things I would consider before purchasing.

[ol]

SSLVPN for Remote users?

IPSec tunneling for remote sites?

Web Filtering for all users, then applying strict polices for some and not for others?

Will You need Active Directory Integration?

Do you need dedicated DMZ ports for on-site web servers?

Web and Internet only, or will Layer 3 Advanced Routing will be enabled?

ForitMail or other SMTP services?

Anti-Virus and IDS\IPS system requirements?

Fiber (SFP+ or Copper ports, or will you need a mix of the two.

WiFi Integration? If you go with FortiWiFi, being able to control all Your APs from a single point is really nice. Plus, after working with Meraki APs, I'm finding that Fortinet's APs are much easier to manage and deploy.[/ol]

Hope this helps! best of luck with whichever device you decide on. Not everyone is a fan of Fortigates, but I am. Once you learn them, it's hard to use other products. Not to mention Fortinet's huge push into their Collective Security Fabric with the more recent Firmware updates. I'm personally just about ready to update to 5.6.

-ChrisRX

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded