Fortinet FortiGate 5001D
Scalable Data Center and Carrier-Graded Security Systems

Architecture:

Flexible and Scalable

• Chassis and blades systems that can be configured for various resiliency and network requirements.
• Security blades can be added as demand grows.
• Ease of maintenance and minimum disruption with hot swappable components

The chassis enables the flexible system to scale effortlessly and with little disruptions by allowing hot swapped blades to be added according to desired requirements. The system can also be configured for various resilience designs within the chassis as well as between chassis. The rack mount ATCA chassis provides centralized and redundant power supplies to its blades. With exception of the FortiGate 5020, the chassis may be powered by either DC or AC with additional power interface. It facilitates backplane communications between the blades which may be used for HA heartbeat and other control and data communications.

The FortiGate 5060, FortiGate 5140B and FortiGate 5144C may house shelf managers that control chassis power allocation, monitor chassis operating parameters, monitor and control chassis cooling, and can signal alerts via alarm module if the chassis encounters problems.

High performance, ASICs powered security blades run on FortiOS or FortiCarrier which apply access policies and security profiles on the traffic they received from the networking blades via backplane or front panel interfaces. These blades may operate in NAT/route and/or transparent mode. They also support virtual systems (VDOMs) within the cluster.

Up to two networking blades may be installed on a FortiGate 5060, FortiGate 5140B and FortiGate 5144C on designated slots. These blades connect the system to the network while connected to the multiple security blades via the chassis's backplane. The networking blade clusters the security blades with traffic distribution. Networking blades can assign security blades into service groups which are isolated clusters coexisting in a single chassis. Two networking blades may either operate as activepassive HA or separately with its own clusters.

Deployment:

Next Generation Perimeter Security

Firewalls alone aren't enough to block today's blended threats and attacks. Data centers require multi-layered security technologies that examine entire packet flows, from content inspection through reassembly, stopping threats at the perimeter. The FortiGate 5000 series offers this critical functionality without compromising performance and scalability.

The FortiGate 5000 series delivers comprehensive security for Managed Security Service Providers (MSSPs). The full suite of ASIC-accelerated security modules allows for customizable features for specific customers, while virtualization features like Virtual Domains (VDOMs) provide up to 6,000 separate security domains. Finally, the full suite of Fortinet integrated management applications — including granular reporting features — offer unprecedented visibility into the security posture of customers while identifying their highest risks.

The ATCA chassis and components of the FortiGate 5000 series are ideal for telecommunication operators and service providers with standard-based assurance for reliability and robustness. Its unbeatable high capacity is essential as data networks continue to grow rapidly in the near future.

Chassis:

FortiGate 5020
Compact 4U chassis that contains two redundant AC power modules and can install one or two FortiGate 5000 security blades.

FortiGate 5060
Mid-sized 5U 19-inch rack mount ATCA chassis that contains two redundant hot swappable DC Power Entry Modules (PEMs) and can install up to six FortiGate 5000 series blades.

FortiGate 5140B
13U 19-inch rack mount ATCA chassis that contains two redundant hot swappable DC Power Entry Modules (PEMs) and can install up to 14 FortiGate 5000 series blades. It also includes four hot swappable front pluggable cooling fan trays.

FortiGate 5144C
Next Generation 13U 19-inch rack mount ATCA chassis with 40 Gbps Backplane and capable of Dual-Dual-Star topology. It can install up to 14 FortiGate 5000 series blades.

AdvancedTCA™ (ATCA)-compliant Chassis

• Based on industry's conforming standards assuring carrier-grade performance, reliability, 99.999% availability and serviceability.
• Redundant fans, power modules and self managers and alarm modules options.*
• Highly scalable with minimum service disruptions as hot swapped blades may be added to increase capacity with ease.
• Comprehensive management and monitoring facilities via shelf managers and alarm modules.**

* Available options depending on chassis models *
* Available on 5060 and 5140B

Blades:

Security Blades

FortiGate 5001B
Security blade ideal for basic firewalling using NP4.

FortiGate 5001C
Security blade that is powered by CP8 and NP4 for superior firewall and UTM performance.

FortiGate 5101C
Powered by FortiASIC SP3 to provide unmatched UTM and IPv6 Firewall Performance, most ideal for next generation networks.

FortiGate 5001D
Latest purpose-built FortiGate security blade with carrier-class capacity and protection.

FortiSwitch 5203B
Flexible security blade that provides investment protection by transforming into a networking blade when scalability is required.

Powered by FortiASIC

• FortiGate® consolidated security appliances are purpose-built to provide essential security technologies for your network. Powered by FortiASIC custom processors, FortiGate platforms deliver unmatched cost/performance for any size network.

Content Processor: Accelerate computationally intensive tasks

• Accelerates packet content matching with signatures
• High performance VPN bulk data engine
• Key Exchange Processor support high performance IKE and RSA computation
• Message authentication module offers high performance cryptographic engine, used by applications such as WAN optimization and SSL Inspection

Network Processor: The heart of low latency and high performance traffic processing

• Supports firewall acceleration with large capacity, including multicast traffic
• Provides IPsec ESP encryption/decryption processing at blazing speed
• Scale firewall throughput independent of packet size
• Operates at the interface level to provide an ultra low latency performance
• Up to 10 million sessions of searching and dynamic network address translation (DNAT)

Security Processor

• Offload CPU for firewall, VPN and flow-based UTM processing
• Accelerates IPv6 Firewalling

Networking Blade

FortiSwitch 5003B
Basic L2 switching blade for aggregating security blades within a chassis.

FortiSwitch 5203B
Flexible networking blade that can either operate as a standalone full featured FortiGate or in content cluster mode, as a FortiGate unit (weighted) load balancing traffic to one or more security blades.

FortiController 5103B
As a high capacity stateful load balancer, this networking blade distributes sessions to multiple FortiGate security blades using state of the art FortiASIC TP acceleration.

Software Features:

FortiOS Dashboard — Single Pane of Glass Management

Proven with Industry Validation
FortiGate received the most industry's certifications among its competitions, assuring top-notch feature quality to provide you with air tight security and best-of-breed security protection.

Unique Visibility and Control
FortiOS allows greater traffic visibility and more consistent, granular control over users, devices, applications and sensitive data. Dashboard widgets allow administrators to quickly view and understand real-time network activities and threat situations.

Ease of Use
FortiOS lowers operation costs and reduces IT staff workloads. Physical or virtual FortiGate appliances give you the flexibility to match your security to your environment while enforcing a uniform security policy. Single pane of glass management and centralized analysis ensure consistent policy creation and enforcement while minimizing deployment and configuration challenges.

Comprehensive Systems Integration
Integration with external systems is possible with wide range of interfacing protocol support and certified solution partners. Network operators can rely on facilities such as SNMP, sFlow and syslog for monitoring purposes. Integration with provisioning systems and custom portals are also possible with Web Service APIs via FortiManager. Scripting using various scripting languages is also supported by manipulating CLI commands.

Robust Virtual Systems
FortiOS Virtual Domains (VDOMs) is a proven method of dividing a FortiGate unit/cluster into two or more virtual units that function as multiple independent units. It has the industry's most comprehensive virtualization capabilities that meet today's complex MSSP deployments.

Extensive Network Support
FortiOS supports numerous network design requirements and interops with other networking devices. This includes support for a wealth of routing, multicasting and network resiliency protocols. Administrators can also configure interfaces for VLANs, VLAN trucks, port aggregation and one-arm sniffer mode.

Identity-Centric Enforcement
FortiOS supports both local and remote authentication services such as LDAP, RADIUS and TACACS+ to identify users and apply appropriate access policies and security profiles accordingly. It may also simplify identitybased implementations and also provide seamless users authorization experience with various single sign-on capabilities. One such application is to retrieve subscriber's information via RADIUS accounting messages and apply appropriate security services dynamically for a managed service provider.

FortiOS has strong PKI and certificate-based authentication services and also integrates an internal two-factor token server for additional security.

Superior IPS Capabilities
The FortiGuard IPS subscription service provides FortiGate customers with the latest defenses against stealthy networklevel threats. With signatures of more than 4000 known threats, it enables FortiGate to stop attacks that evade conventional firewall defenses. It also provides behavior-based heuristics, enabling the system to recognize threats for which no signature has yet been developed.

Powerful Policy Management
It is common in service provider and data center networks to have hundreds, if not thousands of security policies, hence to be able to manage these policies effectively is critical to minimize configuration errors and complexity. FortiOS has the unique ability to provide two forms of policy management views — Global and Section view helps administrators to choose an option that they are most familiar with or suit their requirements best. It also provides powerful features such as policy object search, tagging, sorting and filtering. Policy objects can easily be edited from the policy table.

With FortiManager integration, customers may also have the ability to setup sophisticated policy implementation and provisioning workflows for compliance or operation requirements. Detailed configuration audit trail is supported and can reside externally for secured storage with FortiAnalyzer.

Flexible Role-based Administration
Access profiles can be defined to provide granular access to VDOMs and system functionalities. This is valuable in facilitating enterprise-class or complaint security operation workflows.

Broad IPv6 Support
Maintaining security for both IPv4 and IPv6 traffic will be crucial to the success of mixed networks. Malware and network threats are independent of IPv4 or IPv6. FortiOS is able to use IPv6 security policies to provide access control and UTM protection for IPv6 traffic.

FortiOS has been successfully evaluated as compliant with core protocol and interoperability tests defined by IPv6 Ready Logo Phase 2.

More Features with FortiCarrier Software License

• MMS Security — MMS AV, bulk Email detection and filtering, MMS Address Translation, DLP archiving
• GTP Security — GTP Firewall, protocol anomaly protection, identity filtering, anti-overbilling

Specifications:

¹ Optional FortiGate 5053B Power Supply Shelf used to provide AC power to the FortiGate
** Based on fully populated FortiGate 5001D
*** Please refer to respective Chassis Guide for computation of total power requirement.

* Operating in Standalone Mode
Note: All performance values are "up to" and vary depending on system configuration. Antivirus performance is measured using 44 Kbyte HTTP files. IPS performance is measured using 1 Mbyte HTTP files.

*Operating in Distribution Mode

Clustering Options

FortiGate Chassis Platforms Clustering The networking blades, security blades and the chassis together form clusters. This technique load balances network traffic across the cluster, helping to enhance the scalability, reliability, and availability of mission-critical IP-based services, such as firewall, antivirus, web filtering, IPS, and so on. It also provides high availability by detecting host failures and automatically redistributing traffic to the hosts within a chassis. Clustering simplifies large scale security gateway deployment as configuration synchronization and firmware upgrades can be executed automatically within the clusters.

AC Power Supplies

FortiGate 5053B and PowerSupplyUnit 5000B The FortiGate 5053B is a 1U 19-inch rack mount power supply shelf with PSU-5000B hot swappable power supplies to convert AC power to DC power and to supply power to a FortiGate 5000 series chassis.

Documentation:

Download the Fortinet FortiGate-5000 Series Datasheet (.PDF)