Signs a firewall needs to be replaced

[dcworthi]

Hey folks. Newbie here.

I'm not a networking person (more software pm and technical sales), so please excuse my ignorance on the subject.

Our IT consultancy says that we should considering purchasing new firewall appliances to replace our 60D models; the organization has grown over the past few years, but not astronomically. My understanding from networking friends is that problems are often more related to software license limits than CPU. Its justification is that mobile device traffic isn't being covered (they say our firewalls couldn't handle the extra coverage) and that we're 'on the edge' of normal operation.

We see no evidence that they're operating "on the edge". What are the signs we should look for that will tell us we do need a new firewall and how can we monitor that and be alerted when it happens? Thank you.

-d

[Iescudero · Accepted solution]

Hi There!

"...What are the signs we should look for that will tell us we do need a new firewall and how can we monitor that and be alerted when it happens?..:"

There are a lot things to consider, but i think this is the basics:

1) CPU Usage: If most times is working around 100 %

2) RAM Usage: If enters in conserve mode frequently, ie: the Ram usage is over 80% most of the times.

3) Sessions: The numbers of new and concurrent sessions is near 4000 and 500.000 respectively

4) You reached another maximum value like policy, routes, throughput, etc...

5) Because the growth, you need more interfaces available.

You can check here the specs of the Fortigate 60D: https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/FortiGate_FortiWiFi_60D_Series.pdf

Hope it helps!

[ede_pfau · Accepted solution]

With Fortigates, limits you most often meet are UTM performance and memory size. Licensing is not a concern as all features are covered by a bundle license which only concerns the methods to scan traffic (i.e. signatures for AV, IPS, AppControl, webfilter), even features added during use.

If either UTM has to scan too much traffic or in too many respects the CPU usage will get high; IMHO a proper sized FGT will not see 50% CPU load constantly so that there's room for peak loads. OTOH some UTM and proxy features need memory - the more you scan the higher the memory footprint. If it exceeds 80% then the FGT will start switching off services so this should never happen. If you see 20-40% memory load after a reboot, slowly increasing to <= 50%, you probably have a right-sized FGT.

With new threats coming on constantly, and the current switch to HTTPS-only websites, more performance is needed from a FGT (keyword is "deep scanning" of SSL encrypted traffic). In the desktop, entry models (everything below a 100D) CPU performance is quite limited. Some figures like firewalling troughput and IPsec VPN throughput (which is encrypted as well) look quite good, others like SSLVPN do not. On the bigger models, specialized ASICs process traffic which offloads the CPU substantially.

So, depending on the number of UTM features used, the number of users and the WAN bandwidth, it might very well be that you've outgrown a 60D. Seems your consultant may have made a valid point.

[Iescudero · Accepted solution]

Hi There!

"...What are the signs we should look for that will tell us we do need a new firewall and how can we monitor that and be alerted when it happens?..:"

There are a lot things to consider, but i think this is the basics:

1) CPU Usage: If most times is working around 100 %

2) RAM Usage: If enters in conserve mode frequently, ie: the Ram usage is over 80% most of the times.

3) Sessions: The numbers of new and concurrent sessions is near 4000 and 500.000 respectively

4) You reached another maximum value like policy, routes, throughput, etc...

5) Because the growth, you need more interfaces available.

You can check here the specs of the Fortigate 60D: https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/FortiGate_FortiWiFi_60D_Series.pdf

Hope it helps!

[ede_pfau · Accepted solution]

With Fortigates, limits you most often meet are UTM performance and memory size. Licensing is not a concern as all features are covered by a bundle license which only concerns the methods to scan traffic (i.e. signatures for AV, IPS, AppControl, webfilter), even features added during use.

If either UTM has to scan too much traffic or in too many respects the CPU usage will get high; IMHO a proper sized FGT will not see 50% CPU load constantly so that there's room for peak loads. OTOH some UTM and proxy features need memory - the more you scan the higher the memory footprint. If it exceeds 80% then the FGT will start switching off services so this should never happen. If you see 20-40% memory load after a reboot, slowly increasing to <= 50%, you probably have a right-sized FGT.

With new threats coming on constantly, and the current switch to HTTPS-only websites, more performance is needed from a FGT (keyword is "deep scanning" of SSL encrypted traffic). In the desktop, entry models (everything below a 100D) CPU performance is quite limited. Some figures like firewalling troughput and IPsec VPN throughput (which is encrypted as well) look quite good, others like SSLVPN do not. On the bigger models, specialized ASICs process traffic which offloads the CPU substantially.

So, depending on the number of UTM features used, the number of users and the WAN bandwidth, it might very well be that you've outgrown a 60D. Seems your consultant may have made a valid point.

[emnoc · Accepted solution]

Also to add to the above,

You need to take advantage of newer features and your FortiOS OSes is limit of EoL. ( yes I had a customer who struggle to get off  FortiOS 3.x and his FGT300s) ;)

Other issues  that can requires a upgrade;

 you need more thru-put (duh)

 you need more vdom

 you need faster processor for off-load

 you need faster interfaces 100 ver 1000 ver 10000 megs for example

 you plan to deploy  a wireless overlay and the hardware can't support it ( FAPs and FAP models and  types )

Etc...

[dcworthi]

Thank you all for your help.