VLAN vs Hardware Interface performance and security

Question

I'm getting ready to replace an ASA with an FG200E. On the ASA I have a portchannel of all 6 GBE interfaces and all my firewall interfaces are vlans beneath that portchannel. Before I do the same thing on the FG I thought should see if there are any reasons not to do that. I know from experience that FG has some pretty goofy restrictions on how interfaces can be configured, like not being able to use aggregated and individual interfaces in the same vlan.

So here are my concerns in particular: I have 14(ish) vlans. I want to create each vlan interface under a 6 port aggregate (PortChannel1).

I will be enabling things like LDAP/AD authenticated browsing, virus, forticlient, etc.

Are the WAN1/2 interfaces “special” in some way that I should be concerned about?

Is there any performance hit on the FG in using a lacp aggregate of 6 physical interfaces rather than individual interfaces?

I may want to add a second 200E for HA. Anyone know if there are any problems/restrictions when using HA and Aggregated links? Other thoughts in general about using aggs in the FG?

ede_pfau · Accepted Answer

One more hint: while setting up the LACP trunk watch the subtle differences in heartbeat frequency between FGT and Cisco. When I set up a trunk to a Cisco switch it turned out the FGT was sending heartbeats every second whereas the switch did so only twice a minute. There's a parameter for this in the 'system interface' section on the FGT.

Then again the ASA might not follow the switch's behavior in this respect.

xlntech · Answer

I've been researching this and I don't think there is any reason for concern. The one thing I found that I'm not sure whether it matters or not is that there are two separate PCI buses in the FG200E. Ports WAN1 thru 8 are on the first and ports 9 thru 18 the second. Otherwise, other than mgmt/ha, all interfaces are the same and there is nothing special about Wan1/2.  The mgmt/ha interfaces are on a separate Intel NIC with direct access to the CPU.  Since I don't see a reason not to do it this way I decided to aggregate WAN1/2 into a 2 port bundle(portchannel0) with my internet vlans in it and ports 9-12 as portchannel1 with the 'internal' vlans. I figure it can't hurt anything to split the two aggs between the PCI buses. If anything, it shouldn't make it run worse.

Sign up

Login with SSO

Login to the community

Login with SSO