Choosing Between FortiGate 100D and 200D

[andrew_ang]

I'm setting up a new office that will have a little under 200 users. I'm not sure which product to use. I'm thinking of getting either 2 units of the 100D set up in HA mode, or a single 200D. With the 100D, I can setup a full mesh with a set of stacked switches to avoid single points of failure. I'm a little worried about the lifetime of 100D if we turn on logging since its using flash storage. And getting a fortianalyzer is out of the budget. Any advice? Thanks. Andrew

[ede_pfau]

You could log into memory. The default mem size for this is ~ 90KB but can be configured to 10% of the built-in RAM (in these cases, 200 MB). Even 4 MB, if logs are chosen wisely, can cover a lot of time and events.

That said, if I had a choice and only budget for 2x 100D or 1x 200D, I'd always take the 200D. If protecting and scanning my 200 users is overwhelming my FGT then a cluster won't help. Prepare for a quick express hardware exchange service and take the more powerful one. If absolutely necessary, request budget for a cluster member next year.

[emnoc]

 And getting a fortianalyzer is out of the budget.

you have so many other options free to low cost;

* forticloud ( free with set limits)

* if you have a virtualize env a simple stroke linux/bsd  host  with let's say 8-20gig of storage  is more than adequate

* a physical host setup  for logging  if you don't have a virtualize env

Everybody jump on the "local logging limits" and in fact more many other  similar  sized firewalls from  the others  vendors DellSonicwall/ASA/etc..... have  the same or similar  restrictions and  people get by with these in similar sized offices

Now between the 2  models, the user count is one issue but what do you plan on doing ( explicit proxy, web-url filter, AS,etc.....)

What bw upstream ( 1 , 2,3,4,5, gigs or are we talking megs )

But units are ready available the 200D would be more

Neither have hardware acceleration so that point is mute ( you need a 300D or better  but the price jumps $$$$s )

[Alby23]

HA should NEVER be considered as a solution in order to increase firewall performance in a new implementation.

You have to dimension the performance on a single-unit basis.

At most, you could consider A-A at the end of the life of the apparatus just to have the time to order/configure new appliance generation; at the end... not at the beginning.

[andrew_ang]

Thanks for the feedback everyone.

OK. So that means 100D is out. I plan to use Application Control, IPS, Web Proxy/Filtering, and am planning to test out the AV. I also have 4 VPN Point to Point tunnels. Bandwidth is planned at 2x40Mbps LB from 2 different ISPs, and we may increase if needed.

We had a 60D previously and I chose that because of the advertised throughputs, and that's where it kept locking up because the application control was eating up the CPU. So I had to carefully choose the NGN services and turned off a couple of them on the policies.

Do you think 200D would be able to accommodate plus/minus 200 users?

[Alby23]

It's a bit borderline.

200 users, 80 cumulative Mbps Internet and all or almost all utm features is a lot of computational power.

You could surely accomplish this with a 200D but you have to fine tune it; a 300D has an overwelming power due to the NP6 and IPS performance.

[andrew_ang]

I think that's what happened to me on the 60D when we had 40 users, because I checked the bandwidth throughput.  I don't want to go through that again though. :( 

300D is a little over double the price of the 200D. Do you recommend that we go for this? I wanna take advantage of all the features especially the IPS and DLP (I have those turned off on the 60D right now). 

I gotta do some arm twisting to get the budget though. hehe

[Ralph1973]

Hi, consider what happens when you buy the 200D and imagine that e.g. the powersupply fails and the system goes down, what then? Waiting for replacement within 4 hours? This kind of contract is expensive, while in the meantime nobody will have internet access...

If you have HA , then business can continue (there is no downtime) and the unit can replaced without that much hurry (warranty) or next business day (depends on contract).

According to the situation you describe (full UTM) you might consider 200D in HA. Though both 100d and 200d have CP8 which improves (flow based) UTM, vpn and AV performance. The 200d has an NP4lite Asic, which the 100d lacks.

Use Forticloud for logging, or log to (64GB) storage. The unit uses (separate) flash storage to boot the FortiOS

kind regards,

Ralph Willemsen

[andrew_ang]

Hi Ralph,

Yes, I did consider that. What I'm planning to do is to make use of a 60D in the cabinet, and use that as a "manual" backup in the worst case that the 200D fails. We have a technical services department that should be able to handle the physical port switch. Not ideal, but might be better than nothing.

I will need to turn off any UTM functions for the 60D and have it act as a regular firewall. Configuration management is going to be a headache, since I need to make sure any changes on the 200D (Port forwarding, etc.) get propagated to the 60D, and that would need to be done by hand.

Andrew

[Ralph1973]

Hi Andrew,

Good luck ;) Failure happens at the moment you expect it the least (e.g. while you have a day off), but organizing a 60D in case of failure of the 200D is a headache indeed.

One benefit: you only have to renew your UTM every year/ three years for only 1 unit instead of 2 ;)