Questions - FG30E and FG50E logging/DMZ + HR4860W OEM FG-61E FortiOS compatibility

[RLED]

Hello Fortinet Comunity, I'm new with Fortinet products, and I'm looking a FW Fortinet (with VPN site-site and DMZ capabilities) as starting point for learn implementing and administering platforms like Fortigate 2000E (v6.2.3 build 1066), and searching into datasheets and FortiOS 6.2.3 supported platforms, I have the following questions:

1) Regarding lack of local logging and reporting capabilities of FG30E and FG50E, this can be solved with any Syslog server where logs and info reporting can be exported, right?.

2) Can FG30E and FG50E support VPN site-site and DMZ (even if they haven't a dedicated DMZ interface like FG-61E)?

3) I find a HR4860W that is an OEM FG-61E, those OEM devices can support FortiOS 6.2.3 or be upgraded with any FortiOS version for FG-61E (as any other FG-61E)?.

Regards.

[boneyard]

RLED wrote:

1) Regarding lack of local logging and reporting capabilities of FG30E and FG50E, this can be solved with any Syslog server where logs and info reporting can be exported, right?.

yes, they can send their logging to a syslog server or FortiAnalyzer

RLED wrote:

2) Can FG30E and FG50E support VPN site-site and DMZ (even if they haven't a dedicated DMZ interface like FG-61E)?

yes, the labels on ports are usually just that, labels. exception is management port which should not be used for actual traffic.

RLED wrote:

3) I find a HR4860W that is a OEM FG-61E, those OEM devices can support FortiOS 6.2.3 or be upgraded with any FortiOS version for FG-61E (as any other FG-61E)?.

no personal experience but this reddit thread says yes: https://www.reddit.com/r/...ortigate_60d_question/

[Toshi_Esumi]

For 1), or FortiCloud. With some limitations (last 7 days), it's free.

[RLED]

Hello, @boneyard+@toshiesumi, thanks for your answers.

Also, I'm looking into the other platforms that support FortiOS 6.2.3 (https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/8a24425a-72a1-11ea-9384-005056...), and I find a 100-D, however, as in "Disk Logging" filed appears that could have this feature or not, one of those 100-D I'm interested shows in " get system status" command output "Log hard disk: Available", ¿Does it mean that actually support Disk logging feature?.

Regards.

[Toshi_Esumi]

I think so. However, those NP4Lite NPU models are no longer supported from 6.2. 6.0.x is the last FortiOS for 60Ds.

[RLED]

toshiesumi wrote:

I think so. However, those NP4Lite NPU models are no longer supported from 6.2. 6.0.x is the last FortiOS for 60Ds.

Hello @toshiesumi: Do you say that even if FortiOS 6.2.3 compatibility matrix says that 60D are supported, actually Fortinet is labeling this family as EOL?.

RLED wrote:

Also, I'm looking into the other platforms that support FortiOS 6.2.3 (https://fortinetweb.s3.am...X-623-202003-R31.pdf), and I find a 100-D, however, as in "Disk Logging" filed appears that could have this feature or not, one of those 100-D I'm interested shows in " get system status" command output "Log hard disk: Available", ¿Does it mean that actually support Disk logging feature?.

Also, I’m still looking for a 100D, as it’s within the FortiOS 6.2.3 compatibility matrix, however, this platform is no longer supported or next to EOL? Or, could be a good starting point for learn Fortinet and be prepared for administering models like 2000E?.

Regards.

[Toshi_Esumi]

Look a little closer to the matrix. There is no 60D listed. Only 60E, 60F, 600D, etc. The release notes says the same:

https://docs.fortinet.com/document/fortigate/6.2.3/fortios-release-notes/760203/introduction-and-sup...

As far as I know 60D and 200D are dropped from the support by 6.2 or later because of NP4lite NPU. On the other hand 100D doesn't have NPU, only CP8. So it's still in the list as you might have noticed.

Speaking of end of life, they announce End of Support(EOS) datas for older models. If you have a support login, you can see it at the support site. But by assuming you don't, those models EOS dates are below:

100D - 2023-07-26

60D - 2023-090-23

The last support contract renewal date is a year before the EOS dates, because the shortest contract term is one year. Just note that even after EOS dates, they never stop working unless the hardware broke. You just can't have any support and you run them at your own risk.

[Toshi_Esumi]

Forgot to mention, after EOS date there is no FortiGuard services, like UTM, etc.

[RLED]

Toshi Esumi: 

toshiesumi wrote:
Look a little closer to the matrix. There is no 60D listed. Only 60E, 60F, 600D, etc. The release notes says the same:https://docs.fortinet.com...n-and-supported-models

 Sure, I didn't mention the 60D in my original or latter posts, as in my initial review of 6.2.3 compatibility matrix the 60D's weren't present, actually you mentioned that platform in this thread, so I wanted to clarify: 

toshiesumi wrote:
I think so. However, those NP4Lite NPU models are no longer supported from 6.2. 6.0.x is the last FortiOS for 60Ds.

 And my second question: 

RLED wrote:
Also, I’m still looking for a 100D, as it’s within the FortiOS 6.2.3 compatibility matrix, (…), could be a good starting point for learn Fortinet and be prepared for administering models like 2000E?.

 I still want to know if in your experience, 100D is a good starting point for learn Fortinet, and be prepared for administering models like 2000E.

Regards.

[boneyard]

it is a fine starting point, in all honesty for learning any model is fine. you are not going to get a serious benefit from 60E vs 100D or 60D vs 100D or ... there are small differences but most is the same.

but that but as mentioned just be aware that the latest available is already not possible on the 100D, so you will get more then enough out of it for the next year, perhaps two depending on how fast your production environment is going to move forward with firmware.

personally i wouldn't buy D series for a lab / learning now, i would go for at least E series. but again if you really need something now and the budget only allows D series you will be fine. also keep in mind what you buy probably comes without active UTM licence so you will be missing some functionality there if that is enabled in production.