Can I have two separated network working on a Fortigate 60E?

roudy · ‎11-12-2020

Hi, I am deciding to buy a Fortigate 60F or 80F for my network.

My ISP has 2 separated network(from the same fibre) like most dedicated internet.

The dedicated one is 1 gbps, the dhcp one is like 300 or sth.

I think the best solution for it would be buying two separated firewall for each room but I kind of want to know that if I could simply plug both cable from the modem into the same firewall and have them running as two separated network.

Does it require a Vlan setup to separate them?

How does the failover gonna works in above case?

Thank you very much.

lobstercreed · ‎11-12-2020

You most definitely don't need two firewalls for this. You have a plethora of options available to you to accomplish what you want.

If the two "rooms" are different customers, you may simply want to set up two VDOMs on the same firewall and put the inside/outside ports for each one in their own VDOMs. (You could probably also accomplish this with VRFs under the same VDOM - new feature and not something I've played with yet.)

However, if you want WAN failover (so if DHCP WAN fails, room 2 can use static WAN, and vice-versa), then you would probably prefer to keep it all on one VDOM and set up SD-WAN rules to prefer traffic out the appropriate WAN while still allowing both to use either in a failover condition. This is a common configuration and there is a lot of documentation available on it. If you're new to SD-WAN, I would recommend reviewing their training videos (free for 2020) at training.fortinet.com so you can make sure to do it right the first time. :)

As far as 60F or 80F, the specs are similar so I would make your decision based on price. I'm not sure the CPU/RAM differences between the two, but undoubtedly the 80F is at least slightly beefier so if you can get it for roughly the same price then go for it. I would also recommend the 61F/81F if you can afford the extra price as it can offer longer on-box logging and some other capabilities that the SSD offers.

View solution in original post

lobstercreed · ‎11-12-2020

You most definitely don't need two firewalls for this. You have a plethora of options available to you to accomplish what you want.

If the two "rooms" are different customers, you may simply want to set up two VDOMs on the same firewall and put the inside/outside ports for each one in their own VDOMs. (You could probably also accomplish this with VRFs under the same VDOM - new feature and not something I've played with yet.)

However, if you want WAN failover (so if DHCP WAN fails, room 2 can use static WAN, and vice-versa), then you would probably prefer to keep it all on one VDOM and set up SD-WAN rules to prefer traffic out the appropriate WAN while still allowing both to use either in a failover condition. This is a common configuration and there is a lot of documentation available on it. If you're new to SD-WAN, I would recommend reviewing their training videos (free for 2020) at training.fortinet.com so you can make sure to do it right the first time. :)

As far as 60F or 80F, the specs are similar so I would make your decision based on price. I'm not sure the CPU/RAM differences between the two, but undoubtedly the 80F is at least slightly beefier so if you can get it for roughly the same price then go for it. I would also recommend the 61F/81F if you can afford the extra price as it can offer longer on-box logging and some other capabilities that the SSD offers.