Any difference between interface in Manual or PPPoE modes?

[RedMt]

I'm considering changing the primary WAN interface on one of my 100-Ds from manual mode to PPPoE mode. I've not used this mode in a Fortigate device before. Does the firewall behave any differently when using an interface in PPPoE mode vs manual mode?

In case it's relevant I use a lot of the features on these firewalls. That includes site to site VPNs, advanced routing, SSO, most of the UTM features, etc etc etc. 

Thanks for any help.

[ede_pfau · Accepted solution]

There are 2 main differences:

1- firewalls with PPPoE (or DHCP) mode ports cannot form a cluster

2- PPPoE is handled by the CPU. For high bandwidth links (> 130 Mbps) this can be a real burden for smaller FGTs. There's been a thread on this here in the forums.

I personally would always let a dedicated modem do the PPPoE stuff - their hardware is optimized for this. Modem in pass-through mode means that all credentials are stored on the FGT. Should the modem fail (for instance, by overvoltage on the line) then it's cheap and easy to replace, with no changes to the firewall config.

[RedMt]

That's very insightful and gives me extra ammo, thank you.

A local carrier, the only carrier in a remote location, puts a software firewall on their modems and won't provide a modem without that firewall on it. Every time they do maintenance the firewall gets turned back on and kills our connection until we turn it off. They've stated the only way to circumvent the firewall is to put the modem in bridge mode, forcing the firewall interface to act in PPPoE mode. I don't like the idea, but I also don't like our connection dying randomly. 

[ede_pfau]

I hope you noticed that I kind of contradict myself in the last paragraph, sorry for that.

When the modem is in pass-through, the PPPoE negotiations are handled by the FGT's CPU. And as others have found out this can have desastrous effect on overall throughput on small FGTs (at that time it was a model 60 on a 130 Mbps line).

That said, if the line is slower or the FGT has more muscles (compare the SSLVPN performance as an indicator) then I'd always prefer to have the control on the FGT and not on the modem.