Lab suggestions - 600E in production

[scooby2]

We recently put two 600E's into production and want to get something in the lab for prototyping work. Would two 60F's do the job? Obviously performance wise and interface wise there will be a difference but feature wise would the 60F work?

Thanks,

Scooby

[James_G]

Have a look to see if any feature you need is missing on 60e (sorry, can't see same doc for 60f) https://docs.fortinet.com...sfeatureplatformmatrix

[seadave]

Why not use VMs?  Easier to upgrade, snapshot, maintain than a physical box that needs to be replaced every three or four years.  Looks like price for VM0 is just a bit more per unit than 60F.  That is surprising.  Not sure how much memory the 60F has in it.  If you buy something that is too lean (physical or VM), you won't be able to test the same level of features in your 600Ds due to RAM limitations.  I'd ask your rep what they suggest.  I still think VMs are the way to go because if you are using VMWare it is very easy to setup a vSwitch and a few FortiVMs that you can test with in isolation.  Being able to snapshot before loading new firmware is great for rollbacks if you run into problems.  Same should be true for Hyper-V.

http://www.avfirewalls.com/Fortigate-Virtual-Appliances.asp

[ede_pfau]

Generally, there are only a few features missing on the 'desktop' FGTs (FGT 30-90).

1- I think LACP is available only on FG-100's on upwards. (wait, LACP will be available on a 60F with a recent FOS 6.x - check on the forums)

2- Some higher-up FGTs have an internal switch (ISF) which distributes traffic between the ports and the ASICs (a.k.a. SPs, security processors). This can have a marked influence on throughput if you expect high loads which need to be offloaded. In short, a desktop model cannot simulate a missing internal switch fabric, which in turn leaves you without proper prediction of the behavior of special configurations.

All small models are based on a SoC3 or SoC4 where the ASICs (NP and CP) are integrated with a RISC CPU on a single die. IMHO not having a 'real' CPU has less impact than not having a switch hardware. But, YMMV.

As you already take into account that smaller boxes feature less memory and CPU power you might get away with a, like, 200E. Real CPU, decent memory size, but still no hardware switch. A 300E will have all of that.

If a FGT-VM is 'similar' enough for your demands is hard to tell. It's quite a challenge to run a VM with 20 Gbps throughput whereas a 60F will just allow to do that. Again, feature-wise there are not many differences between HW and VM but only you can tell if these are important.