Hot!Questions - FG30E and FG50E logging/DMZ + HR4860W OEM FG-61E FortiOS compatibility

Author
RLED
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/11/09 17:43:30
  • Status: offline
2020/11/14 15:01:28 (permalink)
0

Questions - FG30E and FG50E logging/DMZ + HR4860W OEM FG-61E FortiOS compatibility

Hello Fortinet Comunity, I'm new with Fortinet products, and I'm looking a FW Fortinet (with VPN site-site and DMZ capabilities) as starting point for learn implementing and administering platforms like Fortigate 2000E (v6.2.3 build 1066), and searching into datasheets and FortiOS 6.2.3 supported platforms, I have the following questions:
 
1) Regarding lack of local logging and reporting capabilities of FG30E and FG50E, this can be solved with any Syslog server where logs and info reporting can be exported, right?.
2) Can FG30E and FG50E support VPN site-site and DMZ (even if they haven't a dedicated DMZ interface like FG-61E)?
3) I find a HR4860W that is an OEM FG-61E, those OEM devices can support FortiOS 6.2.3 or be upgraded with any FortiOS version for FG-61E (as any other FG-61E)?.
 
Regards.
post edited by RLED - 2020/11/15 12:00:32
#1
boneyard
Gold Member
  • Total Posts : 364
  • Scores: 16
  • Reward points: 0
  • Joined: 2014/07/30 11:15:18
  • Status: offline
Re: Questions - FG30E and FG50E logging/DMZ + HR4860W OEM FG-61E FortiOS compatibility 2020/11/15 07:35:38 (permalink)
0
RLED
1) Regarding lack of local logging and reporting capabilities of FG30E and FG50E, this can be solved with any Syslog server where logs and info reporting can be exported, right?.

 
yes, they can send their logging to a syslog server or FortiAnalyzer
 
RLED
2) Can FG30E and FG50E support VPN site-site and DMZ (even if they haven't a dedicated DMZ interface like FG-61E)?

 
yes, the labels on ports are usually just that, labels. exception is management port which should not be used for actual traffic.
 
RLED
3) I find a HR4860W that is a OEM FG-61E, those OEM devices can support FortiOS 6.2.3 or be upgraded with any FortiOS version for FG-61E (as any other FG-61E)?.



no personal experience but this reddit thread says yes: https://www.reddit.com/r/...ortigate_60d_question/
#2
Toshi Esumi
Expert Member
  • Total Posts : 2336
  • Scores: 227
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
Re: Questions - FG30E and FG50E logging/DMZ + HR4860W OEM FG-61E FortiOS compatibility 2020/11/15 09:29:56 (permalink)
0
For 1), or FortiCloud. With some limitations (last 7 days), it's free.
#3
RLED
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/11/09 17:43:30
  • Status: offline
Re: Questions - FG30E and FG50E logging/DMZ + HR4860W OEM FG-61E FortiOS compatibility 2020/11/15 11:57:38 (permalink)
0
Hello, @boneyard+@toshiesumi, thanks for your answers.
 
Also, I'm looking into the other platforms that support FortiOS 6.2.3 (https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/8a24425a-72a1-11ea-9384-00505692583a/SWMTX-623-202003-R31.pdf), and I find a 100-D, however, as in "Disk Logging" filed appears that could have this feature or not, one of those 100-D I'm interested shows in " get system status" command output "Log hard disk: Available", ¿Does it mean that actually support Disk logging feature?.
 
Regards.
#4
Toshi Esumi
Expert Member
  • Total Posts : 2336
  • Scores: 227
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
Re: Questions - FG30E and FG50E logging/DMZ + HR4860W OEM FG-61E FortiOS compatibility 2020/11/15 13:48:30 (permalink)
0
I think so. However, those NP4Lite NPU models are no longer supported from 6.2. 6.0.x is the last FortiOS for 60Ds.
#5
RLED
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/11/09 17:43:30
  • Status: offline
Re: Questions - FG30E and FG50E logging/DMZ + HR4860W OEM FG-61E FortiOS compatibility 2020/11/18 19:01:30 (permalink)
0
toshiesumi
I think so. However, those NP4Lite NPU models are no longer supported from 6.2. 6.0.x is the last FortiOS for 60Ds.

 
Hello @toshiesumi: Do you say that even if FortiOS 6.2.3 compatibility matrix says that 60D are supported, actually Fortinet is labeling this family as EOL?.
 
RLED
Also, I'm looking into the other platforms that support FortiOS 6.2.3 (https://fortinetweb.s3.am...X-623-202003-R31.pdf), and I find a 100-D, however, as in "Disk Logging" filed appears that could have this feature or not, one of those 100-D I'm interested shows in " get system status" command output "Log hard disk: Available", ¿Does it mean that actually support Disk logging feature?.

 
Also, I’m still looking for a 100D, as it’s within the FortiOS 6.2.3 compatibility matrix, however, this platform is no longer supported or next to EOL? Or, could be a good starting point for learn Fortinet and be prepared for administering models like 2000E?.
 
Regards.
#6
Toshi Esumi
Expert Member
  • Total Posts : 2336
  • Scores: 227
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
Re: Questions - FG30E and FG50E logging/DMZ + HR4860W OEM FG-61E FortiOS compatibility 2020/11/18 19:41:47 (permalink)
0
Look a little closer to the matrix. There is no 60D listed. Only 60E, 60F, 600D, etc. The release notes says the same:
https://docs.fortinet.com/document/fortigate/6.2.3/fortios-release-notes/760203/introduction-and-supported-models
As far as I know 60D and 200D are dropped from the support by 6.2 or later because of NP4lite NPU. On the other hand 100D doesn't have NPU, only CP8. So it's still in the list as you might have noticed.
 
Speaking of end of life, they announce End of Support(EOS) datas for older models. If you have a support login, you can see it at the support site. But by assuming you don't, those models EOS dates are below:
100D - 2023-07-26
60D - 2023-090-23
The last support contract renewal date is a year before the EOS dates, because the shortest contract term is one year. Just note that even after EOS dates, they never stop working unless the hardware broke. You just can't have any support and you run them at your own risk.
#7
Toshi Esumi
Expert Member
  • Total Posts : 2336
  • Scores: 227
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
Re: Questions - FG30E and FG50E logging/DMZ + HR4860W OEM FG-61E FortiOS compatibility 2020/11/18 19:48:53 (permalink)
0
Forgot to mention, after EOS date there is no FortiGuard services, like UTM, etc.
#8
RLED
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/11/09 17:43:30
  • Status: offline
Re: Questions - FG30E and FG50E logging/DMZ + HR4860W OEM FG-61E FortiOS compatibility 2020/11/18 20:14:39 (permalink)
0
Toshi Esumi:
 
toshiesumi
Look a little closer to the matrix. There is no 60D listed. Only 60E, 60F, 600D, etc. The release notes says the same:
https://docs.fortinet.com...n-and-supported-models

 
Sure, I didn't mention the 60D in my original or latter posts, as in my initial review of 6.2.3 compatibility matrix the 60D's weren't present, actually you mentioned that platform in this thread, so I wanted to clarify:
 
toshiesumi
I think so. However, those NP4Lite NPU models are no longer supported from 6.2. 6.0.x is the last FortiOS for 60Ds.

 
And my second question:
 
RLED
Also, I’m still looking for a 100D, as it’s within the FortiOS 6.2.3 compatibility matrix, (…), could be a good starting point for learn Fortinet and be prepared for administering models like 2000E?.

 
 
I still want to know if in your experience, 100D is a good starting point for learn Fortinet, and be prepared for administering models like 2000E.
 
Regards.
#9
boneyard
Gold Member
  • Total Posts : 364
  • Scores: 16
  • Reward points: 0
  • Joined: 2014/07/30 11:15:18
  • Status: offline
Re: Questions - FG30E and FG50E logging/DMZ + HR4860W OEM FG-61E FortiOS compatibility 2020/11/18 23:04:27 (permalink)
0
it is a fine starting point, in all honesty for learning any model is fine. you are not going to get a serious benefit from 60E vs 100D or 60D vs 100D or ... there are small differences but most is the same.
 
but that but as mentioned just be aware that the latest available is already not possible on the 100D, so you will get more then enough out of it for the next year, perhaps two depending on how fast your production environment is going to move forward with firmware.
 
personally i wouldn't buy D series for a lab / learning now, i would go for at least E series. but again if you really need something now and the budget only allows D series you will be fine. also keep in mind what you buy probably comes without active UTM licence so you will be missing some functionality there if that is enabled in production.
 
#10
Toshi Esumi
Expert Member
  • Total Posts : 2336
  • Scores: 227
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
Re: Questions - FG30E and FG50E logging/DMZ + HR4860W OEM FG-61E FortiOS compatibility 2020/11/19 08:45:44 (permalink)
0
Totally depending on how you want to use/deploy it. If you just want to study/learn I would look for the cheapest as possible. If it needs to handle more than a few IPSec VPNs I wouldn't go to a device that doesn't have NPU like 100D. 60D might be better for VPNs but now it's considered very slow for all other stuff after E and F series are introduced. We were very glad we could replace those 60Ds to 60Es for many customers. 
#11
RLED
New Member
  • Total Posts : 6
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/11/09 17:43:30
  • Status: offline
Re: Questions - FG30E and FG50E logging/DMZ + HR4860W OEM FG-61E FortiOS compatibility 2020/11/19 19:09:31 (permalink)
0
boneyard
it is a fine starting point, in all honesty for learning any model is fine. you are not going to get a serious benefit from 60E vs 100D or 60D vs 100D or ... there are small differences but most is the same.
 
but that but as mentioned just be aware that the latest available is already not possible on the 100D, so you will get more then enough out of it for the next year, perhaps two depending on how fast your production environment is going to move forward with firmware.
 
personally i wouldn't buy D series for a lab / learning now, i would go for at least E series. but again if you really need something now and the budget only allows D series you will be fine. also keep in mind what you buy probably comes without active UTM licence so you will be missing some functionality there if that is enabled in production.
 



toshiesumi
Totally depending on how you want to use/deploy it. If you just want to study/learn I would look for the cheapest as possible. If it needs to handle more than a few IPSec VPNs I wouldn't go to a device that doesn't have NPU like 100D. 60D might be better for VPNs but now it's considered very slow for all other stuff after E and F series are introduced. We were very glad we could replace those 60Ds to 60Es for many customers. 




Hello boneyard+toshiesumi, thanks for your answers:
 
1) I check again the 6.2.3 compatibility matrix and I find that the FG-80E (81E) series is above 30E, and has the disk logging capabilities 30E lacks.
 
2) For this and following your advices for cost-benefit, is better to have an E series, if is for learning to eventually be prepared for administering a 2000E, and one to have VPN site-site, DMZ, Layer3 intervlan routing, the 81E or 91E can be a good choice, right?
 
Regards.
 
#12
boneyard
Gold Member
  • Total Posts : 364
  • Scores: 16
  • Reward points: 0
  • Joined: 2014/07/30 11:15:18
  • Status: offline
Re: Questions - FG30E and FG50E logging/DMZ + HR4860W OEM FG-61E FortiOS compatibility 2020/11/20 00:52:18 (permalink)
0
yes, 81E is a good choice for that, there are some complaints about the 9xE series, but again for learning that won't bother you i believe.
#13
Jump to:
© 2020 APG vNext Commercial Version 5.5