FortiGate Sizing - Church

[SecurityPlus]

How does one go about selecting a FortiGate model for use in a church. Through most of the week there are only 8 users on the network. For a few hours on Sunday there may be 100 users. The use case on Sunday is fairly basic using the common UTM feature to keep guest users safe on the web. Traffic shaping will be used for video streaming from one computer. Third party wireless access points will be used. In one installation an SD-WAN with a 100 Mb / 12 Mb connections will be in use. In another installation a single 25 Mb fiber connection will be used. Cost needs to be a careful consideration. Would a 60E be appropriate?

[ede_pfau · Accepted solution]

Second thought: why not arrange for a test FGT and let it run for 2 weeks? That would totally ensure the FGT is fit for the job, and it doesn't cost anything (or better, much).

[Toshi_Esumi · Accepted solution]

My opinion is similar to Ede's. I would try a 60E first. Probably just ok unless you start adding a lot of FortiGuard/UTM services like IPS, etc.

[James_G · Accepted solution]

Hi, I have a couple of locations where I have a WiFi network put in for staff to connect mobile devices to when they are on site, isolated network from corporate, just internet access. Both sites have 100mbs link to isp, and peak at over 300 devices connected, all being served by a couple of fgt 50e devices each site in HA. The 50e units are rock solid stable and manage everything the users can throw at them, the only day I ever had an issue was when iOS 11 was released and the 50% of users with apple devices all downloaded on the same day! And... that was a limit of the isp not the firewall. The 50e are amazing units for this task, I have web filter, app control and av enabled, as said before, never seen the little unit struggle.

[ede_pfau]

IMHO, the only feature that might surpass the 60E's capabilities is serving the 100 users on Sunday.

I assume: 100 people surfing, each opening 100 connections via HTTP, that is 10.000 sessions.

The 60E can sustain 1.3 million sessions, and can open sessions at a rate of 30.000 sessions per second.

So, letting 100 users loose would take the 60E like 1/3rd of a second.

All figures from the current datasheet.

I wouldn't necessarily trust my calculations but I do trust the 60E to handle that kind of load.

Where it could pinch would be using web filter (to protect the innocent) but that is not hardware limited but 'cloud' limited - as fast as FTNT can return ratings.

[ede_pfau · Accepted solution]

Second thought: why not arrange for a test FGT and let it run for 2 weeks? That would totally ensure the FGT is fit for the job, and it doesn't cost anything (or better, much).

[SecurityPlus]

One challenge. My estimate concerning the number of users includes room for growth so that we don't put a solution in then overwhelm its capacity in the next few years. The two week trial that you mentioned would not experience this larger quantity of users. Otherwise it seems to be a good solution.

[Toshi_Esumi]

In a couple of years probably 60F(?) would be available with higher performance and better/new services. If a church grow quickly, they would have more budget for IT. I would focus on just current needs. 

[SecurityPlus]

Thanks. Understand. So based on the description I provided would a 60E likely meet their needs now?

[Toshi_Esumi · Accepted solution]

My opinion is similar to Ede's. I would try a 60E first. Probably just ok unless you start adding a lot of FortiGuard/UTM services like IPS, etc.

[SecurityPlus]

Thanks

[James_G · Accepted solution]

Hi, I have a couple of locations where I have a WiFi network put in for staff to connect mobile devices to when they are on site, isolated network from corporate, just internet access. Both sites have 100mbs link to isp, and peak at over 300 devices connected, all being served by a couple of fgt 50e devices each site in HA. The 50e units are rock solid stable and manage everything the users can throw at them, the only day I ever had an issue was when iOS 11 was released and the 50% of users with apple devices all downloaded on the same day! And... that was a limit of the isp not the firewall. The 50e are amazing units for this task, I have web filter, app control and av enabled, as said before, never seen the little unit struggle.

[SecurityPlus]

Thanks. Good points.