3

I am planning to procure a UTM/Firewall device for our office network of 50 Nodes (can be increased upto 75). I want a comprehensive solution for optimum ISP bandwidth utilization, corporate content protection, Traffice security. Breaking up the requirement in features we can consider ISP failover, Bandwidth shaping, Bandwidth optimization, Browsing control, Intrusion Prevention, Data Leakage Prevention etc. Moreover there will be 10-20 VPN users and one site-to-site VPN. But my main focus is on local network security and browsing control and performance. Over VPN, the work criticallity won't be much.

In search of a suitable device, I am evaluating tech specs of some Fortigate models. But I bit confused comparing the features of different models. IF some of my question can be clarified here then I can proceed further in my evaluation.

A) Difference in performance of SoC based models and CPU base models considering primary requirement as Browsing control, Traffic security etc and secondary purpose as VPN Gateway? What I understood 60D/70D/90D are all SoC based models and 80D/92D/100D are all CPU based models.

B) Is there any significant necessity of Internal storage other than log storing capacity? As I found, 60D, 70D do not have any Internal storage, but 90D, 92D, 100D have internal storage. 70D and 90D have same feature except availability of internal storage.

C) Is it a practical thought to make this UTM/Firewall device works as VLAN router as well?

Improve this question
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin♦ Aug 12 '17 at 19:14
1

A) SoC based models are able to offload processing to the silicon, cpu based models are not as optimized and may implement certain functions in software and not hardware

For more information click

B) Depending on the model internal storage may be used for logging, wan optimization and caching purposes

C) It depends... If you need segmentation between your VLANs it might be a consideration but keep in mind that a firewall has certain throughput limitations that you should think of. Your setup is rather small so I think you got about 3 segments (DMZ, Clients, Server).... If that is the case and you are using fileservers etc. you may not want to route Client and Server VLAN on the firewall but only DMZ for seperation between your trusted and untrusted zone...

If you need any more information let me know.

Improve this answer
  • Appreciate your prompt reply. Actually I am confused when I see the model matrix. If I consider 2 models 90D and 92D I noticed some key feature differences. Few differences are not so huge but some parameters significantly differ. Close differences are Firewall Throughput: 3.5Gig vs 2.5Gig Concurrent Sessn: 2M vs 1.5M But I observed, 92D way behind in case of Layer 3 functionality, other hand whenever packet scan or signature verification matters come, 90D falls hugely. – Arindam Banerjee Oct 10 '15 at 17:16
  • It can be seen, 90D winner in, Firewall Latency: 4 MicroSec vs 47 MicroSec. IPSEC VPN Thruput: 1 Gig vs 130 Mbps only But, 92D ahead in Antivirus Thruput: 35M vs 300M SSLVPN: 35M vs 170M IPS Thruput: 275M vs 950M Now, if my purpose is to have device majorly for network security, traffic scanning, browsing control (includes https destinination control) as well feature like bandwidth shaping, bandwidth quota etc. Then which device will perform well for me? – Arindam Banerjee Oct 10 '15 at 17:24
  • If security > performance is your priority I would go for the 92D. Keep in mind that this is my recommendation based on the requirements you mentioned. If you really want to choose the right model that fits your purposes write down what you really want and need. ACLs between internal VLANs? Throughput from LAN to WAN (what is your upstream speed)? – kaisero Oct 10 '15 at 21:16
  • We are a soft dev house. Major internet surfing for dev related and remote support (RDP, TeamViewer etc). Few sales guys need skype, chat. Device Purpose: ISP Failover & Load balance between 2x4Mbps LeasedLine; Network Secutirty: Intrusion prevention, Packet scan, Attachment scan, other threat protection; Internet Browsing Control: Control HTTP & HTTPS sites by domain group/category etc.; Control application based Internet access (P2P, Chat, File Sync etc); Traffic Shaping:B/W allocation based on Device (VidConf)/Usergroup/Destination; – Arindam Banerjee Oct 12 '15 at 7:21
  • Some more: Data Protection(DLP): FileType wise monitoring and control; Hosting: Few intranet site will be hosted; Few service like MSSQL, RDP might be hosted; VPN: 10-15 Remote users to connect office network (Not so active), VPN with remote office (to connect PBX, VC device etc.); Monitor and Report: Live usage, Userwise/Devicewise/Destinationwise/Usagewise reports. – Arindam Banerjee Oct 12 '15 at 7:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.