7 Solutions
I have added the 92D in the comparison mix; between these 3 models, hands down the 90D can't be beat in shear firewall and IPSec throughput. However, the 90D is lacking in firewall new sessions per second and anti-virus scanning. Both the 92D and 100D outperforms the 90D in IPS/anti-virus scanning throughput.
I can't see myself deploying a Fortigate without providing or setting up some sort of IPS/anti-virus protection to the client -- in this regard I'd likely choose the 92D or 100D over the 90D. And if price and annual subscription fee were an issue, I may choose the 92D (depending on how close in price between the two).
That said, real life numbers are more important than theoretical max values -- with 30-40 users on a 100 Mbit connection, I'm sure all 3 models will perform equally in most areas, especially with proper coding/optimizing on the Fortigate config.
My bottom line; while the 90D looks attractive on paper for raw firewall/IPSec throughput, I would scope out just how much daily IPsec tunnel traffic is expected to go through the Fortigate. Unless there are mission-critical apps, there may be little to no difference, load-wise, on the IPsec tunnel connection (on any of the models).
MacMaster wrote:But also, back to the question. With all the info we have collected here now, would you still go with the 100D for this clients demands? Or would you agree that a 90D should be a better choice this time?
If the client is adamant about getting the 100D then let him/her make that decision. There are pros/cons to getting either. While the 90D is faster on firewall/IPsec VPN throughput, the 100D may be the better value in the end should the company shift their stance to being more on network security. Real life values play into this as well, e.g. having a fast IPsec VPN connection is nice but only if the other side of that connection can keep up or sustain that throughput. This is why I suggest getting a demo 90D to play around with -- show your client what that 90D can do. That way you can gauge real values, including the CPU/Memory/network performance.
MacMaster wrote:Interesting to hear about the torrent thing. I have a clint with a 60D and they have problems from time to time. What is the best way to check how many sessions that are open on a unit?
Total open sessions do not tell the full picture of where/what type of traffic going through the Fortigate. Unless you have logging/reporting enabled on the Fortigate (or on a FortiAnalyzer), you'll likely need to drill down to the actual sessions for a device, to see what it's up too in real time. Our remote clients prefer an "open firewall rule set", so when they start complaining about slow speeds, we have to login to their units to see where the traffic is going. Of course, in a closed firewall rule set, we would only open the ports needed.
Sounds like you already made up your mind, so run with it -- contact your local Fortinet dealer and ask to borrow a demo 90D to play around with.
Regarding coding/optimizing, it's more of a throwback to the old 4.1/4.2 firmware days where you really needed to craft/tailor the UTM options to the traffic. e.g if your company is an all-Apple Mac shop there may be no real need to craft IPS/anti-virus sensors to Windows-based PCs -- you don't want the Fortigate spending any more time then needed scanning for something that's not there. This includes setting up the proxy options/SSL/SSH inspection options and creating separate fw policies (http/https, pop3, ntp, dns, other, etc.) The attached pic shows an example config (original was created for us by another company which I just expanded upon). It's an "open" firewall rule set. (Our in-house Fortigate is configured differently as a "closed" rule set.)
Regarding 4000 new session -- should be enough, though you will want to keep an eye out for people bittorrenting or running p2p software -- it can take just one or two individuals to bring down an entire network; (Saw this first hand from a client site that had one device opened over 5500 sessions.)
MacMaster wrote:But also, back to the question. With all the info we have collected here now, would you still go with the 100D for this clients demands? Or would you agree that a 90D should be a better choice this time?
If the client is adamant about getting the 100D then let him/her make that decision. There are pros/cons to getting either. While the 90D is faster on firewall/IPsec VPN throughput, the 100D may be the better value in the end should the company shift their stance to being more on network security. Real life values play into this as well, e.g. having a fast IPsec VPN connection is nice but only if the other side of that connection can keep up or sustain that throughput. This is why I suggest getting a demo 90D to play around with -- show your client what that 90D can do. That way you can gauge real values, including the CPU/Memory/network performance.
MacMaster wrote:Interesting to hear about the torrent thing. I have a clint with a 60D and they have problems from time to time. What is the best way to check how many sessions that are open on a unit?
Total open sessions do not tell the full picture of where/what type of traffic going through the Fortigate. Unless you have logging/reporting enabled on the Fortigate (or on a FortiAnalyzer), you'll likely need to drill down to the actual sessions for a device, to see what it's up too in real time. Our remote clients prefer an "open firewall rule set", so when they start complaining about slow speeds, we have to login to their units to see where the traffic is going. Of course, in a closed firewall rule set, we would only open the ports needed.
