edge router

[gatorHeel]

Has anyone had success with the 50B, 60B or 60C as an edge router? Our application is essentially an executive office suite building whereby we have a single fiber circuit (15 Mbps) that we provide as a WAN interface to the individual suites. Each suite needs one or more public IPs. We were looking at some pure routers (Cisco 2811, 2911) and L3 switches (Catalyst 3750, 3560) but it seems like for what we need the Fortigate' s might be a better solution. Our only requirements are to route the public IPs and configure the guarantee/max/priority bandwidth features of traffic shaping. We really aren' t interested in the security features because each interface will have it' s own firewall behind it. So my questions are: 1. How does traffic shaping in the 50B/60B/60C compare to rate-limiting and policing in Cisco devices such as the ones listed above? Does it work well for both ingress and egress? 2. In the limited exposure I' ve had with a 50B (very impressed) there were some issues with SIP ALG and a particular SIP trunk provider (requiring that we disable it). If we configure the device in routing/transparent mode, are things like SIP ALG automatically disabled? We need the traffic to pass through Fortigate without any dynamic port mapping, etc. Thanks for any thoughts or feedback.

[rwpatterson]

Agreed since the device doesn' t have the ability to act on everything being thrown at it, in that situation.

[emnoc]

Don' t know what you mean pure router, I think regardless if your routing, the device is a firewall and will need a FWpolicy NAT or even in Transparent mode. I personally think your mistaking NAT-mode to mean no firewall inspection.

Have you dealt with file sharing and large downloads lately?

Yes What I' m saying on ingress, if some one pings floods your pipe or udp or anything non-connection type of protocol, no matter how much ingress shaping you do, is not going to help you as far as bandwidth over that link. You would need to squash that by the upwind devices, and it' s best done at the egress port before it hits any other layer3 device. Traffic shaping on ingress and policing ( which are 2 different things btw ) have to be thought out and looked at very closely, to see what your trying to accomplish and the desired goal & effect. On egress is simpler and more effective to apply for bandwidth control, QoS assurance, and policing of one' s traffic flows. And to prevent link bandwidth starvation.