FortiDDoS questions from customer

[OndrVecl]

Hello all,

today I had meeting with customer about FortiDDoS and I got some questions for what I can't found answers in documentation.

Could you please help me with them?

1. What exactly means "shared interfaces" on small and mid size fortiddos boxes?

2. Is possible to use single-fiber SFP BX-10D LC?

3. Is possible to use different SFPs on pair of interfaces? For example... LX transciever in port 1 and SX in port 2. and make conversion between them?

Thank you very much

Ondrej

[Rafael_LEHMANI_FTNT]

Hi Ondrej,

1. What exactly means "shared interfaces" on small and mid size fortiddos boxes?

> means RJ45 or Fiber

2. Is possible to use single-fiber SFP BX-10D LC?

> no, see https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/Fortinet_Transceivers.pdf

3. Is possible to use different SFPs on pair of interfaces? For example... LX transciever in port 1 and SX in port 2. and make conversion between them?
>  no

You can ping me offline for any detail.

Rafael

[SteveDDoS_FTNT]

Sorry to contradict Rafael, but:

2. Is possible to use single-fiber SFP BX-10D LC?

Technically, any SFP that meets the SFP MSA standards will work.  Fortinet FortiCare and dev team will not be able to support non-Fortinet SFPs, since there are 1000s and we can't have everything in the labs.  The customer can plug in but if they don't work, partially work, high bit error rate, heat, etc., they can't call us for help. We have not attempted BiDi SFPs. They usually have narrower operating specs than dual-fiber devices.  (If they are going to buy 20 or 30 systems, I might change my mind...)

3. Is possible to use different SFPs on pair of interfaces? For example... LX transceiver in port 1 and SX in port 2. and make conversion between them?

This is supported.  You can even use 1 copper port and one SFP port on the same pair of bridged ports (on the models supporting copper).  This can be used to have an LR/X Single Mode fiber on the outside towards the ISP's PoP for example, with SR Multi-Mode on the inside towards the LAN infrastructure.

The SFP ports are all what is called OEO - they convert Optical to Electrical (in the box) and back to Optical, so they can switch specs along the way.

This is true for all SFP/SFP+ ports on all models.  This is not available on the 10GbE bypass ports (17-20) on the FDD-1200B which are SR/MM only. That is because on fail-open, the ports are connected optically with fiber, so it must be the same on both ports.  We don't make an LX version of the FDD-1200B.

Steve Robinson - stephen@fortinet.com
PM - FortiDDoS, FortiWAN/AscenLink
Phone:  +1-716-261-1308
Mobile: +1-647-308-7686
Skype:  severob8090

[OndrVecl]

Hello Rafael and Stephen,

thank you very much for informations.

But, back please to point one... on FDD400B shared interface contains four metalic and four optic interfaces. So I don't understand what means RJ45 or Fiber.

Thank you

Ondrej

[SteveDDoS_FTNT]

Hi Ondrej,

RJ-45 = Copper - standard Ethernet connector

SFP = Fiber with standard LC connector to the SFP (although the ports support Copper SFPs too). Any MSA-compliant SFP (SR/Lx/BiDi/Copper) will work but Fortinet will only support those shown in its Price List (as mentioned earlier).

I've attached some cabling information.

You will see on the front panel that there are 4 ports in the first group but 2 are labeled "1" and 2 are labeled "2".  You can only use one of each same-numbered ports.  Thus, there are several combinations: 

• Copper-to-Copper (RJ-45-to-RJ-45) - Example: RJ-45 ports 1 and 2. Remember, ODD ports are INSIDE on FortiDDoS
• Fiber-to-Fiber (SFP-to-SFP) - Example: SFP ports 3 and 4
• Copper-to-Fiber Example: - Port 1 RJ-45 and Port 2 SFP

All ports on FortiDDoS are bridged pairs, so you can only use 1-2, 3-4, 5-6, etc.  You cannot use 1-4, for example.

The Copper-to-Copper (RJ-45-to-RJ45) have built-in fail-open but that can be turned off.
Any combination that includes an SFP port is fail-closed since the technology does not allow internal fail-open. You need an external FortiBridge if you need fail-open and are using SFP ports.

If you need copper to fiber conversion across the box, let's have one of the labs check it out again.  While I know this worked some time ago, I am unaware of any customer using it, so we have not checked it for a long time and there have been a few changes with the way we initialize the ports. Let me know your configuration requirements.

Regards,

Steve Robinson - stephen@fortinet.com
PM - FortiDDoS, FortiWAN/AscenLink
Phone:  +1-716-261-1308
Mobile: +1-647-308-7686
Skype:  severob8090

[OndrVecl]

Hello Stephen,

thank you very much!

These slides and your answer really help me!

Thanks, Ondrej