VLAN vs Hardware Interface performance and security

[xlntech]

I'm getting ready to replace an ASA with an FG200E. On the ASA I have a portchannel of all 6 GBE interfaces and all my firewall interfaces are vlans beneath that portchannel. Before I do the same thing on the FG I thought should see if there are any reasons not to do that. I know from experience that FG has some pretty goofy restrictions on how interfaces can be configured, like not being able to use aggregated and individual interfaces in the same vlan.

So here are my concerns in particular: I have 14(ish) vlans. I want to create each vlan interface under a 6 port aggregate (PortChannel1).

I will be enabling things like LDAP/AD authenticated browsing, virus, forticlient, etc.

Are the WAN1/2 interfaces “special” in some way that I should be concerned about?

Is there any performance hit on the FG in using a lacp aggregate of 6 physical interfaces rather than individual interfaces?

I may want to add a second 200E for HA. Anyone know if there are any problems/restrictions when using HA and Aggregated links? Other thoughts in general about using aggs in the FG?

[xlntech]

I've been researching this and I don't think there is any reason for concern. The one thing I found that I'm not sure whether it matters or not is that there are two separate PCI buses in the FG200E. Ports WAN1 thru 8 are on the first and ports 9 thru 18 the second. Otherwise, other than mgmt/ha, all interfaces are the same and there is nothing special about Wan1/2.  The mgmt/ha interfaces are on a separate Intel NIC with direct access to the CPU. Since I don't see a reason not to do it this way I decided to aggregate WAN1/2 into a 2 port bundle(portchannel0) with my internet vlans in it and ports 9-12 as portchannel1 with the 'internal' vlans. I figure it can't hurt anything to split the two aggs between the PCI buses. If anything, it shouldn't make it run worse.

[ede_pfau]

Yeah, why not.

VLAN tag handling is cheap and done in the NP ASIC after session setup. VLAN segmentation is an excellent best practice as broadcasts are eating away bandwidth. If you run several VLANs on the same wire it absolutely makes sense to double the bandwidth of the underlying physical port.

For the WAN ports you might consider link redundancy vs. bandwidth aggregation. Using an LACP trunk you only use one public IP address and one ISP, that is, link redundancy but no provider redundancy. I think you might even combine 2 LACP trunks into one SDWAN interface for both higher bandwidth and redundancy (but never seen it in the field yet).

[ede_pfau · Accepted solution]

One more hint: while setting up the LACP trunk watch the subtle differences in heartbeat frequency between FGT and Cisco. When I set up a trunk to a Cisco switch it turned out the FGT was sending heartbeats every second whereas the switch did so only twice a minute. There's a parameter for this in the 'system interface' section on the FGT.

Then again the ASA might not follow the switch's behavior in this respect.

[xlntech]

With an aggregation of Wan1/2 I can still have multiple ISP's connected. ISP1 = portchannel0.vlan200, ISP2=portchannel0.vlan201. Those can both still end up as interfaces in an SD-Wan config. This way I get port redundancy so I can replace the switch and/or have my ISP routers as an HA pair. I'm not saying I "need" that in this scenario; just that I like having it and not needing it more than the other way around. I was really more concerned that the FG has some ridiculous limitation like not being able to use feature X on a lacp bundle or vlan interface. My experience with FortiLink has made me very cautious when "assuming" things in Fortinet gear.