Your wife asked and you delivered! Excellent work!!
Hello,
I am attempting to find Armstrong Alterna - Golden Glaze in 16"x16" tiles to match existing flooring in my house. According to some local flooring stores, the 16"x16" tile was discontinued in 2021 and only 12"x24" is available now. floorcity.com lists is as "in stock" on their website but they don't actually have any available "in my region".
This is probably a stretch, but does anyone know a place that may potentially have this tile?
Keep in mind these parking lots support Hersheypark, Hersheypark Stadium, Giant Center & Chocolate World. It is not uncommon for a concert at the Stadium & an event at Giant Center to be occurring at the same time while Hersheypark & Chocolate World are also open.
Edit - spelling
This sparks my curiosity as well. It could even go beyond the land under Candymonium. From what I saw on Dauphin Co. parcel viewer, HERCO owns the land on the other side of Park Ave. wrapping all the way around the old Antique Auto Museum property. It is a huge amount of land, maybe 1.5 times the footprint of the current park. That said, I'm not sure how buildable it is or how they can cross Park Ave.
Honestly, I’d go with S4112 if it were my environment. They run OS10 and support VLT which will support in-service software upgrade (ISSU) for dual-homed servers. N3224PX will run OS6 by default which, IMO, is not as stable as OS10. They also will not support ISSU as they leverage standard stacking protocols
Will N32xx switches work? Most likely. But S-Series switches are built specifically for this use-case. I disagree with others who have said S-Series is overkill. I think they’re just right.
EDIT - have you actually received a quote for the N3224PX switches? I wouldn’t be surprised if they’re similarly priced to S4112.
What are the other ToR switches were you quoted? I’m assuming S-Series? What model?
External MAC address? Do you mean External IP address?
Why not just use SSLVPN on the FortiGate? EDIT - assuming your FGT is up to date on patches.
Please do not expose RDP to the public internet.
Can you provide more information about what specifically isn’t working? What firmware versions are you running on Gate and AP?
I could be wrong, but back on July 28 I went to HP in the evening. I was about to ride Skyrush but when walking by I heard some loud bangs as a train was making its way up the lift hill. The ride then closed for the rest of the evening. Since then, I’ve only seen 1 train. I just assumed the two were related.
I went hands up on seat 25 (2nd to last row, left wing seat) a few weeks ago and paid the price. The first drop bent my body in a very unnatural way. I was sore for 3 days. Can’t wait to do it again. I love that ride.
600 series is listed on Fortinet’s website now. No data sheet yet.
Yes it can. I typically skip the FS-200 series due to lack of 10G interface but perhaps that isn’t needed in your situation.
You do not need a port-channel (Trunk in Fortinet's vocabulary) even with 2 firewalls. Please review the "HA-mode FortiGate units managing a stack of several FortiSwitch units" in the following link. https://docs.fortinet.com/document/fortiswitch/7.0.8/devices-managed-by-fortios/801190/ha-mode-fortigate-units-managing-a-stack-of-several-fortiswitch-units
You can achieve ISP redundancy with single-handoffs. Just make sure that each ISP terminates into difference switches. If one switch dies, the other ISP can stay up and running. This is why I mentioned 2 FS-108F as dedicated WAN switches. Each switch acts as an ISP fault domain.
Ah, I see. Maybe go with 2x FS-124F-FPOE switches then?
Are you expecting the ISPs to deliver more than 1 handoff each? I was assuming each would offer a single handoff which is why I recommended landing each in a separate switch.
I'd probably go Fortinet over Meraki solely based on the fact that the Fortinet gear can continue to run if licenses expire. Not sure if you are planning on managing this network long-term and keeping up with renewals. If not, I wouldn't be surprised if renewals are missed and the last thing you want is the network to drop because of that.
Based on the info provided, I'd start with a design like this:
Just a starting point from my perspective!
EDIT - Oh, don't forget about Rackmount.IT for the non-rack-mountable FortiStuff :)
FortiSwitches are pretty good. As others have mentioned, they are best when paired with a FortiGate for management. The FortiGate switch controller is pretty slick. However, there are other management options such as FortiSwitch Manager (VM for central mgmt), FortiLAN Cloud (cloud mgmt like Meraki), and standalone though CLI or GUI.
That said, here are some additional considerations:
FortiSwitches do not support any stacking protocol such as Cisco Stackwise or Aruba VSF. Rather, they offer MCLAG which is their implementation of MLAG (think VPC from Cisco, VLT from Dell, or VSX from Aruba). You can have up to 3 MCLAG tiers and hang additional access switches off of the various tiers. Don’t be fooled by the word “Stack” in their documentation. Their implementation of a “Stack” is switches cabled in a ring topology with Spanning-Tree blocking one of the ports.
Their switch portfolio is slightly behind other vendors such as Cisco, Aruba, Arista from a hardware capability perspective. For example, they only have a single model that offers mGig & UPOE and it’s only 8 of the ports on a 24 port model. They do not have any 25 gig switches. That said, there are some new FortiSwitch models dropping very soon (hopefully) that will address these concerns.
If you choose to manage the switches via a FortiGate, Layer 3 routing is handled at the firewall layer and not the switch layer. You have to make sure you size the FortiGate to accommodate East/West traffic. The benefit to this is that you get an insane amount of visibility to traffic on your LAN. Also, you can apply UTM inspection to inter-VLAN traffic which should make your security team happy.
I would have no problem deploying FortiSwitches in a large enterprise environment. Just do your good research and make sure they work for you 👍
There were some announcements at Accelerate this week around VXLAN. I’m sure more details will be coming soon, but FortiGates will support MP-BGP VXLAN EVPN for this exact use-case in newer FortiOS versions. Might be worth waiting. Unless, of course, you’re running the 7.4 beta 😀
Have you made a request to your Fortinet team to have the feature added?
The 231G and 431G will provide you some level of "future proofing" with the 6E capability. You do not have to enable 6E right away, but you have the option to. But please keep in mind the "G" models can only be managed by FortiGate running 7.2.X firmware and they require either 802.3bt power or 2x 802.3at connections.
EDIT - typo
Yep, you nailed it. Knowing how your apps communicate and what policies are needed is arguably the most difficult part of a microsegmentation implementation. A good partner should be able to help you through this journey or tools such as Aria (formerly vRealize Network Insight) or NSX Intelligence (not my favorite) can help. But, as you mentioned, this will add to the cost and complexity.
If NSX is too costly and complex, maybe you can start with macrosegmentation and run E/W traffic between segments through a NGFW such as Palo or FortiGate?
I would still look at NSX, especially if your environment is fully virtualized in vSphere. You DO NOT have to use all of the complex networking features of NSX that require edges, gateways, etc.. You can use NSX for microsegmention using your traditional, VLAN backed segments (they look and feel just like a normal port group) and maintain a relatively simple deployment. In fact, I believe there are some license levels of NSX that only give you this functionality.
FortiManager Cloud used to be a per device SKU (first one you mentioned) but changed (maybe 2022 Q2 or Q3?) to a single SKU for up to X number of devices (disti’s suggestion).
The SKU disti recommended is correct at the current time. What happens to customers that had already purchased the per device SKU? Don’t know. I’d suggest working with your rep/SE to understand the process.
FortiManager data sheet for reference. If you scroll to the bottom you will see the SKU disti recommended. https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/fortimanager.pdf
Also worth mentioning, FortiManager Cloud (and FortiAnalyzer Cloud) used to require FortiCloud Premium entitlement along with the per device SKU. This is no longer a requirement and shouldn’t play a role.
FS-1048E does support BGP if it has the Advanced Features license and operates in Standalone mode (not managed by FortiGate).
If a FortiSwitch is managed by FortiGate (over FortiLink), the L3 routing occurs on the FortiGate.
I believe if you go to the “FAQ” page, you will find an explanation. IIRC, there is an additional review after both sponsors approve. Mine took a week or two.
FNDN approvals
fortinet