FortiWiFi 60D questions

[HMB]

Hi All,

At the moment we have a FortiWifi 80C (v1 variant with 512MB memory) now on 5.2.2 which works fine, but there are a few things with it that are quite annoying to us, in particular the loud, high pitched fan noise and the incapability of the WiFi part to operate at 2.4GHz and 5GHz simultaneously, so we're considering replacing it.

Based on our traffic and other requirements the FortiWifi 60D looks like a contender, but from the data sheet it isn't clear if it can operate at both 2.4GHz and 5GHz simultaneously (something most $30 home routers can do). It's also not clear if this thing has a fan.

Also, what is the difference between the various hardware rivisions? Are there even any revisions like on the 80C?

Thanks,

H.

[emnoc · Accepted solution]

high pitched fan noise and the incapability of the WiFi part to operate at 2.4GHz and 5GHz simultaneously

Sorry you can't operate integral radio on 2.4 & 5ghz. You can buy a dedicated AP that's dual radio and operate it on 5ghz if so desired.

[ede_pfau · Accepted solution]

hi,

a) ALL FortiWiFi do only have 1 radio (module). IMHO this doesn't have to do with the cost of the unit or it's quality; it's a design decision. I can recommend the FortiAPs which are powerful, have bigger antennas and are fully integrated into ANY Fortigate (for free, if that counts).

b) the 60D is passively cooled, i.e. without a fan. Just be careful not to throw the FGT around as the cooling sink might rip off and the SoC might die by heat.

c) there have been 4 revisions to the 60D model over time. The latest, the greatest - 2 GB RAM. Hardware revisions are not documented to the public, for obvious reasons. You might have a look at this post: FGT platforms with CPU, memory and supported firmware

d) just a heads up: the 80C is quite powerful if you use a lot of AV, IPS, AppControl at the same time, due to it's powerful CPU. The 60D is built upon a SoC2 (system-on-chip) which combines a RISC core with a Fortinet NPlite ASIC on one chip. As such, pure firewall throughput is way higher than that of the 80C but AV is...10% of that. Have a good look at the datasheets.

Same with SSL VPN. If you foresee a high usage of SSL VPN then you should consider a 'real CPU' model, like the 80D, 100D, 92D (this from hearsay, ask Selective).

[emnoc · Accepted solution]

ALL FortiWiFi do only have 1 radio (module).

Yes correct, but some will interpet it wrong. They have 2 band and 1 radios but can't operate on both bands at the same time. Only some  AP have  dual radios and can operate on both bands at the same time.

Also OP, please be careful of the # wifi modes tunnel or not, they can seriously put hurt when it comes to high AP counts if you plan on running the  FWF60D as a controller.

If your FWF80 is working good, I would not downgrade it especially since you  have a MIMO 2x3 vrs 2x2 for the FWF60D. I was also told it's the same  radio in both platforms, so with the FWF80 having a slightly better cpu, you should just keep it unless you need more 1GIGE interfaces.

[emnoc · Accepted solution]

high pitched fan noise and the incapability of the WiFi part to operate at 2.4GHz and 5GHz simultaneously

Sorry you can't operate integral radio on 2.4 & 5ghz. You can buy a dedicated AP that's dual radio and operate it on 5ghz if so desired.

[HMB]

emnoc wrote:

Sorry you can't operate integral radio on 2.4 & 5ghz. You can buy a dedicated AP that's dual radio and operate it on 5ghz if so desired.

Thanks for the information. Additional APs are not an option at the moment so we'll have to live with single band for now.

[ede_pfau · Accepted solution]

hi,

a) ALL FortiWiFi do only have 1 radio (module). IMHO this doesn't have to do with the cost of the unit or it's quality; it's a design decision. I can recommend the FortiAPs which are powerful, have bigger antennas and are fully integrated into ANY Fortigate (for free, if that counts).

b) the 60D is passively cooled, i.e. without a fan. Just be careful not to throw the FGT around as the cooling sink might rip off and the SoC might die by heat.

c) there have been 4 revisions to the 60D model over time. The latest, the greatest - 2 GB RAM. Hardware revisions are not documented to the public, for obvious reasons. You might have a look at this post: FGT platforms with CPU, memory and supported firmware

d) just a heads up: the 80C is quite powerful if you use a lot of AV, IPS, AppControl at the same time, due to it's powerful CPU. The 60D is built upon a SoC2 (system-on-chip) which combines a RISC core with a Fortinet NPlite ASIC on one chip. As such, pure firewall throughput is way higher than that of the 80C but AV is...10% of that. Have a good look at the datasheets.

Same with SSL VPN. If you foresee a high usage of SSL VPN then you should consider a 'real CPU' model, like the 80D, 100D, 92D (this from hearsay, ask Selective).

[HMB]

ede_pfau wrote:

a) ALL FortiWiFi do only have 1 radio (module). IMHO this doesn't have to do with the cost of the unit or it's quality; it's a design decision.

Good to know. It's still a bit strange that they couldn't stretch to two radios on these units.

I can recommend the FortiAPs which are powerful, have bigger antennas and are fully integrated into ANY Fortigate (for free, if that counts).

Unfortunately additional APs are out of the question, which means we will have to live with single band for now.

b) the 60D is passively cooled, i.e. without a fan. Just be careful not to throw the FGT around as the cooling sink might rip off and the SoC might die by heat.

Hm, that doesn't really instill confidence in the hardware quality of the 60D. Something like that should not happen in a $400 or so device.

c) there have been 4 revisions to the 60D model over time. The latest, the greatest - 2 GB RAM. Hardware revisions are not documented to the public, for obvious reasons. You might have a look at this post: FGT platforms with CPU, memory and supported firmware

Thanks for the link. Are you sure the revisions are for the 60D? The page shows the 60C having four revisions, and only one for the 60D (ok, two if you count the POE version).

d) just a heads up: the 80C is quite powerful if you use a lot of AV, IPS, AppControl at the same time, due to it's powerful CPU. The 60D is built upon a SoC2 (system-on-chip) which combines a RISC core with a Fortinet NPlite ASIC on one chip. As such, pure firewall throughput is way higher than that of the 80C but AV is...10% of that. Have a good look at the datasheets.

Same with SSL VPN. If you foresee a high usage of SSL VPN then you should consider a 'real CPU' model, like the 80D, 100D, 92D (this from hearsay, ask Selective).

Both units should be fine, our requirements in terms of throughput are quite low (one 40/8Mbps connection, mostly less than 10 users), so based on the datasheets the 60D should be fine.

The most annoying thing with our 80C is the fan, which can be quite disturbing. The other thing is that this is a Rev 1 unit with only 512MB of memory, and while it hasn't hit conserve mode so far the memory utilization is usually over 80%.

[emnoc · Accepted solution]

ALL FortiWiFi do only have 1 radio (module).

Yes correct, but some will interpet it wrong. They have 2 band and 1 radios but can't operate on both bands at the same time. Only some  AP have  dual radios and can operate on both bands at the same time.

Also OP, please be careful of the # wifi modes tunnel or not, they can seriously put hurt when it comes to high AP counts if you plan on running the  FWF60D as a controller.

If your FWF80 is working good, I would not downgrade it especially since you  have a MIMO 2x3 vrs 2x2 for the FWF60D. I was also told it's the same  radio in both platforms, so with the FWF80 having a slightly better cpu, you should just keep it unless you need more 1GIGE interfaces.

[HMB]

emnoc wrote:

ALL FortiWiFi do only have 1 radio (module).

Yes correct, but some will interpet it wrong. They have 2 band and 1 radios but can't operate on both bands at the same time. Only some  AP have  dual radios and can operate on both bands at the same time.

Well, in my opinion FortiNet doesn't do much to highlight this. From the 60D datasheet http://www.fortinet.com/sites/default/files/productdatasheets/FortiGate-60D.pdf:

"A built-in dual-band, dual-stream access point with internal antennas is integrated on the FortiWiFi 60D and provides speedy 802.11n coverage on both 2.4 GHz and 5 GHz bands."

In my opinion this creates the impression that simultaneous 2.4GHz/5GHz operation is possible, especially when nowhere is stated that its not.

If your FWF80 is working good, I would not downgrade it especially since you  have a MIMO 2x3 vrs 2x2 for the FWF60D. I was also told it's the same  radio in both platforms, so with the FWF80 having a slightly better cpu, you should just keep it unless you need more 1GIGE interfaces.

Aside from the WiFi (with which we could live if necessary) there's still the fan and the low RAM. And especially the fan is a major issue.

[Dave_Hall]

As far as I am aware all wifi models only have one radio (you can actually confirm this yourself by checking the platform listing in the Wifi/Switch Controller/custom AP profile section).

Regarding various hardware revisions, see Bob's post here.

Regarding your existing 80C, I recall someone mentioning on the forums about the fan suppose to have a controllable speed setting, but either is faulty or just "stuck" on high....supposedly it was fixed in v2 though.  (Someone want to follow up/correct me on this?)

I suggest contacting your local Fortinet sales rep (dealer) if you are still considering purchasing a new Fortigate -- they should be able provide you with a test/demo unit for evaluation purposes.

Personally, as emnoc suggests, I would stick with the 80C and just purchase an AP that supports dual radio.  If the 80C is running into memory issues, check out KB #FD35127.

[HMB]

Dave Hall wrote:

Regarding your existing 80C, I recall someone mentioning on the forums about the fan suppose to have a controllable speed setting, but either is faulty or just "stuck" on high....supposedly it was fixed in v2 though.

 

Interesting. I noticed that the fan is controlled (it shortly goes to full speed after power up, and then sits what I guess is around 75%).

(Someone want to follow up/correct me on this?)

I did a short search but didn't find anything, so if someone has more details please chime in!

I suggest contacting your local Fortinet sales rep (dealer) if you are still considering purchasing a new Fortigate -- they should be able provide you with a test/demo unit for evaluation purposes.

That is an option, but before I approach a reseller I'd like to check some basics to make sure it's worth going that route.

Personally, as emnoc suggests, I would stick with the 80C and just purchase an AP that supports dual radio.  If the 80C is running into memory issues, check out KB #FD35127.

Thanks for the link. We did most of it already, and while the box hasn't yet gone into conserve mode memory consumption is generally high. I guess 512MB just isn't cutting it any more.

[ede_pfau · Accepted solution]

I totally get your point with the fan noise. I love the 80C when it's housed in a rack, or at least some sideboard. Apart from the high pitched noise there is very little that makes a 80C obsolete even today.

So the major drawback is the limited memory. Fortunately, FTN has been lavish with recent models, even with the small desktop ones, so that 2 GB is standard nowadays. If you had the rev. 2 80C you could well live with it's 1 GB, even running v5.2.2.

Conserve mode kicks in if the memory consumption grows beyond 80% - which is bad and should be avoided altogether. In conserve mode AV scanning is bypassed (and some other features as well) so the protection level goes down.

My hint at the 60D's heatsink should not deter you from using one. It's just that it happened in the past, and without proper cooling the CPU will be overheated soon. I've got a couple of 60Ds out with customers and have yet to see one single failure. It's quite responsive, got ample ressources and it's the only model with a lot of hardware variants (PoE, WiFi, SFPs). You will enjoy lower contract fees as well.

You're right, I might have confused the HW revisions of 60C and 60D, sorry. With the all new 70D, 80D, 90D and siblings it's more than unlikely that the lower models will see a significant HW revision in the future (IMO).