Dimensioning Fortigates

[#1]

Does someone have any documentation about the dimensions (number of users, servers, etc.) that are supported by each type of fortigate (especially concerning the models of Fortigate 60 / 100 /200 /300 /400 /800) I would like to have the dimensions in (almost) worst case scenerio, so AV, IDS (may decrease highly the performances) and other possibilities activated After calculation, stress and load tests and ponderation i have found next scales: FG 60 : <15 machines (machines = PCs, workstations and servers) FG 100 : 50 machines FG 200 : 60 machines FG 300 : 135 machines FG 400 : 150 machines FG 500 : 130 machines FG 800 : <1000 machines Does any one has more experiences with this kind of calculations or in practic Thanks in advance, Bart - Ipelium

[#2]

From what I gather, FG60' s should be used in site under 10 hosts and FG100' s in sites under 20. Although the hardware is there to handle more, more significant loads seems to cause frequent problems as the firmware code is still maturing.

[#3]

After calculation, stress and load tests and ponderation i have found next scales: FG 60 : <15 machines (machines = PCs, workstations and servers) FG 100 : 50 machines FG 200 : 60 machines FG 300 : 135 machines FG 400 : 150 machines FG 500 : 130 machines FG 800 : <1000 machines

Wooohooo... My FG-300 outperforms an FG-500.

[#4]

We have 60 nodes behind a Fortigate 60, no prob.

[#5]

This is all very subjective. I can have one machine generate traffic of 100 machines, yet I can have 100 machines idling 99% of the time, thus generating a load of 1 machine. For example, my very popular UT server generates 700Gbytes/month. Just one machine.

[#6]

[Deleted by Admins]

[UkWizard]

Christian, you are absolutely right, the smaller boxes have too little memory, especially as they also suffer from memory leaks. Thats exactly why the FGT50A was released, its the same as the FGT50 except for the memory expansion. Memory is cheap nowadays anyway, so dont know why they do that.

[veechee]

ORIGINAL: Christian Heger I think the small boxes could do a lot better if it had a bit more RAM. I do not know what' s in there in absolute numbers - but it should be cheap to stock it up a little!

I totally agree with this statement. I have two FGT-60C' s and the memory usage is the issue with UTM services provisioned. The memory runs low 50' s to mid 60' s at all times, while the CPU usage even under load of 3-10 machines rarely goes above a few percent. Since the memory is whats required to do so many of the things that FGT advertises the devices for, I don' t see why they aren' t a little more generous with it. If I didn' t want UTM, $100 Linksys units with open source firmware can do most of the same stuff. As far as user/machine load, I have one FGT-60C provisioned where there is a server hosting multiple services, six PCs, plus a customer WiFi network that averages 5-10 users at a time. The other I have installed at an office with six PCs and two servers. This week I' m putting a FWF-60C into an office with no servers but 15 PCs. It will be linking back with IPSec and WAN Optimization to the office with two servers. I hope both units can handle it!

[#9]

It is not an issue of machines rather than bandwidth and concurrent connections. I have a case of a 512kb line and a FGT-50 2.36 (not 50A) protecting 30 users a proxy and a mail-server. It works fine (ful AV, URL block of 40.000 urls and so). Memory is an issue when you have for example 50 users downloading files from the web and also have a 10mb (buffer size) for WEB antivirus. If these users start t0 download a 20mb file each one you would need 50x10=500 RAM free for antivirus checking only. If you reduce the web antivirus to 1mb (that is what I do) you need only 1mb for each user thus 50mb total. It is true that lines up to 1mb (internet connections) can be handled easily from any FGT (even 50A) with no problem (for up to 50 users or even more). You buy bigger machines only for LAN to LAN connections (which use 100mb networks or so). Bigger Fortigates are good for endurance (they will have more chances working with newer firmwares)

[UkWizard]

tmavr, Think it works for you because you are on the old firmware revision. Version 2.5 uses more memory, hence the FGT50 problems. Thats why support recommended my customers to drop to 2.36. But the problem is, there are bugs in the VPN on 2.36, so if you want that functionality, you have to go to 2.5. I can pretty much guarantee you will start seeing problems if you up the firmware.