hi,
i'm deciding to redesign my server room and structures,
unfortunately there is no UTM in my network and i need your recommendation to choose a model.
there is a flat network without VLan (all switch are unmanageable)
i use of 12 Physical Windows Servers
and 100 Clients (win XP and 7)
and have 5 megabits internet (avg throughput is 300-400 KB)
and there is 1 E1 line connected to our cisco router (1-1.5 megabits)
which model is suitable for this?
Thnx in Advance
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Some questions before I can give a recommendation
1. This location has how many subnets?
2. If it has multiple subnets, are you going to perform UTM between them?
I assume, based on location size, that you have switches already deployed etc. If it is a flat network you won't need much as you can size based on the bandwidth you will use going out to the internet (which would make a 60/61E a good fit for you).
If you DO have multiple subnets and you are wanting to do UTM between them, depending on the amount of traffic traversing those links you would look at sizing based on that.
Mike Pruett
MikePruett wrote:Thanks Mike for your replySome questions before I can give a recommendation
1. This location has how many subnets?
2. If it has multiple subnets, are you going to perform UTM between them?
I assume, based on location size, that you have switches already deployed etc. If it is a flat network you won't need much as you can size based on the bandwidth you will use going out to the internet (which would make a 60/61E a good fit for you).
If you DO have multiple subnets and you are wanting to do UTM between them, depending on the amount of traffic traversing those links you would look at sizing based on that.
there is only one subnet (Class c : 192.168.0.0)
and i don't think to deploy VLan as soon
i want to use UTM in edge and some servers will be in DMZ
other will keep in LAN
what is your idea about 200D?
Regards
Thanks all
how can measured input / throughput Packet Data fromLAN to firewall?
based on what parameters need to choose a models?
THNX
200D/200E is overkill for your listed requirements, you'll pay a fortune in fortiguard renewals as well. Just get a 60E/61E.
If you are hosting a DMZ with public servers then you have at least 2 subnets. So MikePruett's recommendations apply.
Still, LAN to DMZ traffic usually isn't going to be huge. The 60E is capable of 2.5 Gbps throughput at max and some substantial UTM throughput as well, for a dime and a nickel. This is independent of the packet size (mostly) as this traffic is ASIC accelerated.
And forget about VLANs - VLAN or not, tagging won't cost you anything in performance.
ede_pfau wrote:Thanks ede :)If you are hosting a DMZ with public servers then you have at least 2 subnets. So MikePruett's recommendations apply.
Still, LAN to DMZ traffic usually isn't going to be huge. The 60E is capable of 2.5 Gbps throughput at max and some substantial UTM throughput as well, for a dime and a nickel. This is independent of the packet size (mostly) as this traffic is ASIC accelerated.
And forget about VLANs - VLAN or not, tagging won't cost you anything in performance.
i plan to publishe some services such as IIS & Citrix, but they are a few clients use this services
almost 10-20 and in peek time maybe 30, concurrent connection
10 for Citrix server and 20 for IIS (iis is for status viewing not report)
Yeah, I would say a 60/61E would suit you just fine then. Most of your UTM is going to be applied on the web surfing traffic inside going out. The inside to DMZ traffic won't be as high (bandwidth wise) as you probably think so that won't be an issue.
That being said the 60/61E models are able to do a very nice amount of NGFW throughput (200+ megabits if I'm not mistaken off the top of my head) so it should be more than enough. All in all you will get a powerful product with minimum cost. A 200D would be fun but WAY overkill....that and they don't support VXLan from what I have seen (not that your environment would ever need it in it's current deployment)
Mike Pruett
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1502 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.