I'm setting up a new office that will have a little under 200 users.
I'm not sure which product to use. I'm thinking of getting either 2 units of the 100D set up in HA mode, or a single 200D. With the 100D, I can setup a full mesh with a set of stacked switches to avoid single points of failure.
I'm a little worried about the lifetime of 100D if we turn on logging since its using flash storage. And getting a fortianalyzer is out of the budget.
You could log into memory. The default mem size for this is ~ 90KB but can be configured to 10% of the built-in RAM (in these cases, 200 MB). Even 4 MB, if logs are chosen wisely, can cover a lot of time and events.
That said, if I had a choice and only budget for 2x 100D or 1x 200D, I'd always take the 200D. If protecting and scanning my 200 users is overwhelming my FGT then a cluster won't help. Prepare for a quick express hardware exchange service and take the more powerful one. If absolutely necessary, request budget for a cluster member next year.
* if you have a virtualize env a simple stroke linux/bsd host with let's say 8-20gig of storage is more than adequate
* a physical host setup for logging if you don't have a virtualize env
Everybody jump on the "local logging limits" and in fact more many other similar sized firewalls from the others vendors DellSonicwall/ASA/etc..... have the same or similar restrictions and people get by with these in similar sized offices
Now between the 2 models, the user count is one issue but what do you plan on doing ( explicit proxy, web-url filter, AS,etc.....)
What bw upstream ( 1 , 2,3,4,5, gigs or are we talking megs )
But units are ready available the 200D would be more
Neither have hardware acceleration so that point is mute ( you need a 300D or better but the price jumps $$$$s )
OK. So that means 100D is out. I plan to use Application Control, IPS, Web Proxy/Filtering, and am planning to test out the AV. I also have 4 VPN Point to Point tunnels. Bandwidth is planned at 2x40Mbps LB from 2 different ISPs, and we may increase if needed.
We had a 60D previously and I chose that because of the advertised throughputs, and that's where it kept locking up because the application control was eating up the CPU. So I had to carefully choose the NGN services and turned off a couple of them on the policies.
Do you think 200D would be able to accommodate plus/minus 200 users?
I think that's what happened to me on the 60D when we had 40 users, because I checked the bandwidth throughput. I don't want to go through that again though. :(
300D is a little over double the price of the 200D. Do you recommend that we go for this? I wanna take advantage of all the features especially the IPS and DLP (I have those turned off on the 60D right now).
I gotta do some arm twisting to get the budget though. hehe
Hi, consider what happens when you buy the 200D and imagine that e.g. the powersupply fails and the system goes down, what then? Waiting for replacement within 4 hours? This kind of contract is expensive, while in the meantime nobody will have internet access...
If you have HA , then business can continue (there is no downtime) and the unit can replaced without that much hurry (warranty) or next business day (depends on contract).
According to the situation you describe (full UTM) you might consider 200D in HA. Though both 100d and 200d have CP8 which improves (flow based) UTM, vpn and AV performance. The 200d has an NP4lite Asic, which the 100d lacks.
Use Forticloud for logging, or log to (64GB) storage. The unit uses (separate) flash storage to boot the FortiOS
Yes, I did consider that. What I'm planning to do is to make use of a 60D in the cabinet, and use that as a "manual" backup in the worst case that the 200D fails. We have a technical services department that should be able to handle the physical port switch. Not ideal, but might be better than nothing.
I will need to turn off any UTM functions for the 60D and have it act as a regular firewall. Configuration management is going to be a headache, since I need to make sure any changes on the 200D (Port forwarding, etc.) get propagated to the 60D, and that would need to be done by hand.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.