FortiGate 1100E Throughput VS 40GB interface

[Hitcola]

Hi all,

I need to buy a FortiGate1100E, the NGRW through put as per the documentation is 9.5Gbps, the threat protection throughput is 7Gbps, the SSL inspection throughput is 8Gbps.

however the box itself has two 40GB interfaces and four 25GB interfaces, I just wonder how can I use these 40G and 25G interfaces at their full capacity while the FortiGate throughput is less than these interfaces.

am I missing something

appreciate your help.

[ede_pfau]

Well, there is a difference between traffic throughput and content inspection throughput.

The 1100E is rated at 80 Gbps firewall throughput, thus theoretically saturating it's two 40 Gb interfaces. The other interfaces offer different media but do not add to the overall throughput.

Note that figures like these are extraordinary for a firewall and mainly this is only attainable through offloading to network ASICs/coprocessors (NP).

As Fortigates are not only firewalls, that is, routing and policing traffic between networks, but also used for inspecting traffic content, they employ different coprocessors for this task (CP). The effort for this is way higher than just allowing/blocking traffic, and sometimes includes decryption and encryption in realtime (SSL, IPsec).

Thus, the UTM throughput figures are lower than those for firewalling, but still awsome: IPsec 48 Gbps, SSL-VPN 8.4 Gbps and UTM between 12.5 and 7 Gbps.

Though this still is less than wirespeed, I find that in practice one seldomly sees wirespeed throughput in the range of 10, 40 or 100 Gbps, even if the backbone is capable of that. Often the data sinks are just not powerful enough, or the amount of data only suffices for occasional spikes. Of course, YMMV.

If you need more, there are a number of higher rated Fortigates above the 1100E. Or, even better, if you choose the F series where the new generation of NP and CP deliver 10fold figures, you will get more bang for the buck. Still, plain throughput will always be higher than content inspection.

If your main concern is on UTM then select a Fortigate model based on these figures; get the much higher firewalling throughput as a bonus.

[Hitcola]

Hi ede_pfau,

really appreciate your help, I got it now. 

Thanks for your support.