FGT lab design suggestions

[rb400]

Does anyone have any suggestions for setting up a inexpensive FGT beta lab.

Goal: to test major changes to our 1000D prior to implementing the changes in the 1000D.

We wish to purchase the least expensive Fortinet supportable model for experimentation.  We would then alter the 1000D based on what we learned.

Alternative, are there any techie "clouds" that allow fortigate "what-if" configuration scenarios with interface and vlink simulated data?

[Dave_Hall]

With the exception of the very low-end (certain features have been removed from them), almost any Fortigate device will do -- they all run the same OS.  But take a look at the max values table (link is for 5.0) -- you could try to match up something on that list to the 1000D.

It will be hard trying to replication the same number of interface (ports), so you maybe better off going with one of the VMs.  However, do take a look at the "Total network interfaces" column on the various Product pages to try to match up a low/mid-end model to the number of interfaces your company is actually using on the 1000D.  (e.g. those entry level 90D/92Ds appear to have a lot of ports.)

[emnoc]

IMHO I guess it depends on what "changes" and testing do you really need? This came up b4 ( in this forum ) and I've like Dave have used VMs and other FGTmodels ( FGT60D for example )

If you don't need a firewall instance, and it's in a true lab, I  IMHO would just plumb a vdom named "lab"  or whatever and craft up your  dev env and in this vdom , and once it passes all checks and depts,  you just roll the changes to the  production vdom with the correct fixups on any SRC/DST address. This approach make for easy and rapid changes testing and rollout. In my case it just me lifting a policy from vdom and renaming the src/dst interfaces and dropping it into the production  fwpolicy config.

In the above case you save $$$.$$$ bu not having to buy a 2nd unit and eliminate any extra support or  ports or networks connectivity etc..

Now if you need to lab and beta test  actual FortiOS ,  than by all means but a low end unit but be advise a problem in unit that doesn't match your production hardware-model, might not be exposed or come to light.

I'm working right now with a client that has a development and lab-trainer ALL on virtual instances, we have fortigates VMs and PaloAlto VM for lab training. With PaloAlto ( just to add this ) if you want a real-hardware appliance they have PA-200s that under a lab SKUs. I think fortigate does the same thing  or they lab it as NFR ( not-for-resale ) this approach can save you  tons of dollars if you need real hardware appliances.

They are 100% happy ;)