I would really like the Fortigate to come with a Virtual Copy for HA only.

[David_Bower]

I would really like the Fortigate to come with a Virtual Copy that would only be available on-line if the hardware version failed. Its only purpose would be to keep the company on-line for a limited time, say 10 days.  Meanwhile the IT people would have time to fix or replace the hardware.  With the time limitation and a specific paring to the hardware, there would be little chance the software misuse.

This would really put Fortinet at the front of the competition.

[mnantel_FTNT]

Greetings David,

I'd like to understand your requirements correctly, but I am wondering about the way you would intend this to work. Would the virtual copy feature simply keep a cloud copy of your configuration for easy restoration on a new unit (e.g. through FortiCloud)? Or would you intend to have your firewall fail and have traffic redirected to our cloud for processing? For the later, I do not grasp how we could ensure your organisation's traffic would be redirected to Fortinet if you no longer have an on-premise device?

The former idea is actually a good one, which would possibly make restoration of the configuration simpler. Albeit, it is currently today fairly easy to backup and restore a config from a failed unit to a new unit of the same model using FortiExplorer through the unit's USB port.

Thank you for your feedback!

--

Mathieu Nantel - NSE4, CCIE 24349

Principal System Engineer / Consultant Technique Senior

[David_Bower]

I see the virtual copy running on a single server (physical or VM) behind the Fortigate in a pass-through mode unless it detects a failure of the Fortigate. It can be configured so it has exactly the same configuration and collecting the same logs and is updated automatically when the Fortigate configuration changes.

If the VM senses a failure of the Fortigate, it begins to manage traffic, alerts the IT dept. and starts a countdown clock. I realize there may need to be some physical configuration of switches and/or ethernet ports to manage a complex, multi- interface configuration but at least the network would not go off-line or, at worst, the IT department could have the system back up in minutes while they fix or exchange the Firewall. Fortinet may even be able to re-program one of their small switches to handle the pass-through and full management in the case of a failure.

There are thousands of mid-sized operations that cannot afford a full HA device and this plan would fill that gap.

PS: I don’t charge much for these ideas. ;)

[PaulSpag]

I like this idea. It would really only be a change to the existing HA features that a Fortigate offers now.

Right now, two fortigate units can be in a HA cluster, but they have to be the same exact model. Also the current HA cluster types allows for active-active or active-passive.

I would interpret the suggestion above to mean that Fortinet should expand how HA works to allow for a new cluster type called Active-VM.   This new type would allow dissimilar devices to join a cluster (FGT joined with FGT-VM). The FGT would be the primary (with great performance via ASIC) and the VM would only be used in a failure situation (like active-passive)

*Keep in mind the VM would perform much slower because it would not have an ASIC chip.

I think it would be good to see this change, but I also understand why it isn't there now. Anyone who has a business need for this type of uptime normally has the budget for buying two fortigate units and creating a normal HA cluster.

Certified: Network+, Security+
I enjoy all things related to information security.

[David_Bower]

In Reply to Paul Spagnola, Sec+:

I think it would be good to see this change, but I also understand why it isn't there now. Anyone who has a business need for this type of uptime normally has the budget for buying two fortigate units and creating a normal HA cluster.

I disagree to a point. Many small to medium sized businesses do need the uptime but cannot afford two FGT along with full subscriptions for both units needed for HA.

With a cost of close to 12K for each, you are looking at 24K for 3 years of service. That’s a huge number for many small businesses and – makes those/me want to look into other, more cost effective solutions.

[PaulSpag]

David,
   I undetstand what you are saying, but I must define "small" or "medium" business differently than you do. Your price $12K per device seems high. I have a two unit HA cluster with hundreds of computers behind it and I paid less than the price you mention for a single unit.

-Paul

[David_Bower]

Paul,

We are currently using the 300C with 400+ devices behind it and moving to the 300D.  Those are the current retail prices for the device and a three year UTM/daytime support agreements. I do know they sell a second device for HA at a discount but the UTM/support agreement is not discounted for the second device.

 Dave

[mnantel_FTNT]

Here's a little trick that might help with your scenarios David: you can use an off-the-shelf router of any kind that supports VRRP. So long as it has the same number of interfaces as your FortiGate device and can process a decent amount of bandwidth, insert it in parallel with your FortiGate, and establish a VRRP cluster with your FortiGate as the preemptive master to ensure it is always preferred for your traffic. Falling short of having an HA pair, this might meet your requirements for redundancy!

--

Mathieu Nantel - NSE4, CCIE 24349

Principal System Engineer / Consultant Technique Senior, Office of the CTO

[PaulSpag]

Dave,
I see your point. I can see how the cost would get higher and higher for
the larger units. I just do not consider those small or medium business
size. I think If I were in your shoes I would want to have a FGT-VM that
would take over in the case of a complete fortigate failure. It would be
limited, but would be better than nothing. Fortinet just needs to offer a
special "fail over only" SKU for purchasing a FGT-VM with certain hardware
models. I would have it include Fortiguard at a very reduced price. Then
they would need to allow for a special HA mode so that VM can join the HA
cluster for fail over purposes only.

-Paul

On Fri, Sep 18, 2015 at 3:04 PM, David Bower <
ngfw.pub@fuse-lists.fortinet.com> wrote:

> Paul,
>
> We are currently using the 300C with 400+ devices behind it and moving to
> the 300D. Those are the current retail prices for the device and a three
> year UTM/daytime support agreements. I do know they sell a second device
> for HA at a discount but the UTM/support agreement is not discounted for
> the second device.
>
> Dave
>
> -----End Original Message-----
>

[#10]

I really like the idea of automated configuration backups to the cloud.

In this situation, since the D models are much more capable that the C models, I would suggest looking at backing down to a pair of 200D in an active-active HA pair.

Norris Carden, CISSP, CISA | Sr. Security Engineer | Arnett Group™