FortiWiFi 60D questions

[HMB]

Hi All,

At the moment we have a FortiWifi 80C (v1 variant with 512MB memory) now on 5.2.2 which works fine, but there are a few things with it that are quite annoying to us, in particular the loud, high pitched fan noise and the incapability of the WiFi part to operate at 2.4GHz and 5GHz simultaneously, so we're considering replacing it.

Based on our traffic and other requirements the FortiWifi 60D looks like a contender, but from the data sheet it isn't clear if it can operate at both 2.4GHz and 5GHz simultaneously (something most $30 home routers can do). It's also not clear if this thing has a fan.

Also, what is the difference between the various hardware rivisions? Are there even any revisions like on the 80C?

Thanks,

H.

[emnoc · Accepted solution]

high pitched fan noise and the incapability of the WiFi part to operate at 2.4GHz and 5GHz simultaneously

Sorry you can't operate integral radio on 2.4 & 5ghz. You can buy a dedicated AP that's dual radio and operate it on 5ghz if so desired.

[ede_pfau · Accepted solution]

hi,

a) ALL FortiWiFi do only have 1 radio (module). IMHO this doesn't have to do with the cost of the unit or it's quality; it's a design decision. I can recommend the FortiAPs which are powerful, have bigger antennas and are fully integrated into ANY Fortigate (for free, if that counts).

b) the 60D is passively cooled, i.e. without a fan. Just be careful not to throw the FGT around as the cooling sink might rip off and the SoC might die by heat.

c) there have been 4 revisions to the 60D model over time. The latest, the greatest - 2 GB RAM. Hardware revisions are not documented to the public, for obvious reasons. You might have a look at this post: FGT platforms with CPU, memory and supported firmware

d) just a heads up: the 80C is quite powerful if you use a lot of AV, IPS, AppControl at the same time, due to it's powerful CPU. The 60D is built upon a SoC2 (system-on-chip) which combines a RISC core with a Fortinet NPlite ASIC on one chip. As such, pure firewall throughput is way higher than that of the 80C but AV is...10% of that. Have a good look at the datasheets.

Same with SSL VPN. If you foresee a high usage of SSL VPN then you should consider a 'real CPU' model, like the 80D, 100D, 92D (this from hearsay, ask Selective).

[emnoc · Accepted solution]

ALL FortiWiFi do only have 1 radio (module).

Yes correct, but some will interpet it wrong. They have 2 band and 1 radios but can't operate on both bands at the same time. Only some  AP have  dual radios and can operate on both bands at the same time.

Also OP, please be careful of the # wifi modes tunnel or not, they can seriously put hurt when it comes to high AP counts if you plan on running the  FWF60D as a controller.

If your FWF80 is working good, I would not downgrade it especially since you  have a MIMO 2x3 vrs 2x2 for the FWF60D. I was also told it's the same  radio in both platforms, so with the FWF80 having a slightly better cpu, you should just keep it unless you need more 1GIGE interfaces.

[HMB]

Danke für die Ausführungen!

ede_pfau wrote:

I totally get your point with the fan noise. I love the 80C when it's housed in a rack, or at least some sideboard. Apart from the high pitched noise there is very little that makes a 80C obsolete even today.

The funny thing is that the main purpose of the fan seems to make a whining noise, as its airflow is patheticly low, and there is nothing visible in its air path that requires cooling. The major heat source in this thing is the CPU and the NP, and the latter is completely off the fan's air path (and the low air flow will only have a neglegible effect on the CPU temperature).

I'm sure the 80C would work just fine without the fan.

So the major drawback is the limited memory. Fortunately, FTN has been lavish with recent models, even with the small desktop ones, so that 2 GB is standard nowadays. If you had the rev. 2 80C you could well live with it's 1 GB, even running v5.2.2.

Conserve mode kicks in if the memory consumption grows beyond 80% - which is bad and should be avoided altogether. In conserve mode AV scanning is bypassed (and some other features as well) so the protection level goes down.

The device was used as a firewall only (no UTM subscriptions), and even when memory consumption is high I haven't seen running ito conserve mode. However, to test I now activated the UTM trials on that device, and and now it hits conserve mode frequenclty according to the log. I tried some of the tricks mentioned in the KB (like disabling memory logging) but that barely makes a difference. It does help disabling some of the services but even then it does hit conserve mode occasionally.

Maybe 5.2.2 is just not suitable for 512MB devices. I don't want to go back to 4.0, though. I wonder if 5.0.9 is a better choice for that box, though.

My hint at the 60D's heatsink should not deter you from using one. It's just that it happened in the past, and without proper cooling the CPU will be overheated soon. I've got a couple of 60Ds out with customers and have yet to see one single failure. It's quite responsive, got ample ressources and it's the only model with a lot of hardware variants (PoE, WiFi, SFPs).

Well, the 60D does look quite attractive, especially with its high firewall performance. And 2GB RAM should be sufficient for a long time (and many FortiOS releases). I did notice the SFP variants, which would be a bonus. It's a shame that there's no FortiWiFi 60D with SFP, though.

You will enjoy lower contract fees as well.

Yes, I noticed that. The 60D subscriptions seem to be a lot lower than for the 80C.

You're right, I might have confused the HW revisions of 60C and 60D, sorry. With the all new 70D, 80D, 90D and siblings it's more than unlikely that the lower models will see a significant HW revision in the future (IMO).

That's probably true. And I guess since memory is cheap these days it's probably easier now for FortiNet to put sufficient memory in their boxes. It's just a shame that the memory in the 80C seems to be soldered on and not in module form, otherwise expansion would be an option.

So I guess I'll have to keep an eye out for a good deal on a FWF-60D then.

Thanks for the help!

[londonnet]

No fan and I would suggest using a good quality external wifi access point