Fortinet's latest firewall promises hyperscale security while sipping power
(2023/04/13)
- Reference: 1681338725
- News link: https://www.theregister.co.uk/2023/04/12/fortinet_efficient_dc/
- Source link:
Fortinet claims its latest firewall can secure an entire datacenter while consuming about a quarter the power of its competitors.
On Tuesday the security vendor [1]unveiled the FortiGate 7081F, a next-gen firewall (NGFW) targeting hyperscale datacenters that need to inspect large volumes of traffic traveling both in and out and across the datacenter network.
At 12RU in size, the firewall is among Fortinet's largest, and capable of 1.2Tbps of raw firewall throughput, it's also one of their highest performance. Though, we'll note that just like every firewall, the performance figures do drop off rather precipitously to around 310-370Gbps when additional functionality like SSL inspection, IPsec VPN, or threat protection are toggled on.
[2]
But according to Fortinet, what really sets the firewall apart from the competition isn't just performance, but efficiency as well. Fortinet says the firewall can achieve this performance while consuming 73 percent less power than its competitors. This is possible because Fortinet, which is no stranger to [3]severe vulnerabilities in its own kit, is one of the few manufacturers of its kind still spinning its own security and networking ASICs.
[4]
[5]
The modular chassis can be equipped with up to six of the company's own processor modules, each of which incorporates its NP7 network processing and CP co-processing ASICs to offload a variety of workloads like intrusion detection and antivirus from the host CPU.
"CPUs do some things well and other things not well, so if a vendor were to use off the shelf chips, they will get outstanding performance with some things and poor performance with others (like encryption with security). Some vendors will drop a second CPU in there for offload, or perhaps use a DPU," ZK Research analyst Zeus Kerravala tells The Register .
[6]
Using ASICs, security vendors can optimize the silicon to their specific workloads, typically achieving higher performance and greater efficiencies, at the expense of rigidity, he explained.
"To add new features, you need to spin a new chip so the R&D investments tend to be a bit higher but the end result is a better performing product at a lower cost," Kerravala said. "It makes acquisitions harder as the new features need to be ported to silicon. This is why Fortinet tends to build things in house."
[7]It's time to stop fearing CPU power management
[8]Cloud can reduce greenhouse emissions, but don't assume it's automatic
[9]Just because on-prem is cheaper doesn't make the cloud a money pit
[10]AWS wants to cook its datacenter chips with vegetable oil
According to Fortinet's spec sheet, the 7081F is capable of delivering 312Gbps of Threat Projection at 23.4W/Gbps. Its closest competitor, Fortinet claims, is Palo Alto Networks' PA-5450, which actually edges it out in efficiency, but can't keep up in terms of raw performance, at just 200Gbps of raw firewall throughput or 123Gbps with Threat Protection enabled.
But while the FortiGate 7081F might pack higher performance into a modular chassis, it isn't without caveats, with power consumption, ironically, being one of them. Based on [11]Fortinet's numbers , the 7081F should consume somewhere in the neighborhood of 7.3 kilowatts when fully loaded. That's well within the capabilities of the chassis' six 2500W power supplies, but could prove problematic when it comes to rack power delivery.
As we've previously reported, on average most datacenter racks today are under 6kW of capacity, though 10kW and higher racks are becoming more common. Depending on your existing power infrastructure, a single 7081F could conceivably consume the entire rack power budget, unless modifications are made. ®
Get our [12]Tech Resources
[1] https://www.fortinet.com/blog/business-and-technology/fortigate-7081f-next-generation-firewall
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/energyefficientdatacenters&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZDd@ZdezsVQamdKCJ1D6oAAAANg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2022/10/11/fortinet_critical_flaw/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/energyefficientdatacenters&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZDd@ZdezsVQamdKCJ1D6oAAAANg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/energyefficientdatacenters&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZDd@ZdezsVQamdKCJ1D6oAAAANg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/energyefficientdatacenters&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZDd@ZdezsVQamdKCJ1D6oAAAANg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2023/04/12/cpu_power_management_feature/
[8] https://www.theregister.com/2023/04/12/gartner_are_clouds_greener/
[9] https://www.theregister.com/2023/04/11/cloud_dc_costs/
[10] https://www.theregister.com/2023/03/20/aws_wants_to_cook_its/
[11] https://docs.fortinet.com/document/fortigate-7000/hardware/fortigate-7081f-system-guide/423540/power-consumption-for-different-fim-7921f-fortigate-7081f-configurations
[12] https://whitepapers.theregister.com/
On Tuesday the security vendor [1]unveiled the FortiGate 7081F, a next-gen firewall (NGFW) targeting hyperscale datacenters that need to inspect large volumes of traffic traveling both in and out and across the datacenter network.
At 12RU in size, the firewall is among Fortinet's largest, and capable of 1.2Tbps of raw firewall throughput, it's also one of their highest performance. Though, we'll note that just like every firewall, the performance figures do drop off rather precipitously to around 310-370Gbps when additional functionality like SSL inspection, IPsec VPN, or threat protection are toggled on.
[2]
But according to Fortinet, what really sets the firewall apart from the competition isn't just performance, but efficiency as well. Fortinet says the firewall can achieve this performance while consuming 73 percent less power than its competitors. This is possible because Fortinet, which is no stranger to [3]severe vulnerabilities in its own kit, is one of the few manufacturers of its kind still spinning its own security and networking ASICs.
[4]
[5]
The modular chassis can be equipped with up to six of the company's own processor modules, each of which incorporates its NP7 network processing and CP co-processing ASICs to offload a variety of workloads like intrusion detection and antivirus from the host CPU.
"CPUs do some things well and other things not well, so if a vendor were to use off the shelf chips, they will get outstanding performance with some things and poor performance with others (like encryption with security). Some vendors will drop a second CPU in there for offload, or perhaps use a DPU," ZK Research analyst Zeus Kerravala tells The Register .
[6]
Using ASICs, security vendors can optimize the silicon to their specific workloads, typically achieving higher performance and greater efficiencies, at the expense of rigidity, he explained.
"To add new features, you need to spin a new chip so the R&D investments tend to be a bit higher but the end result is a better performing product at a lower cost," Kerravala said. "It makes acquisitions harder as the new features need to be ported to silicon. This is why Fortinet tends to build things in house."
[7]It's time to stop fearing CPU power management
[8]Cloud can reduce greenhouse emissions, but don't assume it's automatic
[9]Just because on-prem is cheaper doesn't make the cloud a money pit
[10]AWS wants to cook its datacenter chips with vegetable oil
According to Fortinet's spec sheet, the 7081F is capable of delivering 312Gbps of Threat Projection at 23.4W/Gbps. Its closest competitor, Fortinet claims, is Palo Alto Networks' PA-5450, which actually edges it out in efficiency, but can't keep up in terms of raw performance, at just 200Gbps of raw firewall throughput or 123Gbps with Threat Protection enabled.
But while the FortiGate 7081F might pack higher performance into a modular chassis, it isn't without caveats, with power consumption, ironically, being one of them. Based on [11]Fortinet's numbers , the 7081F should consume somewhere in the neighborhood of 7.3 kilowatts when fully loaded. That's well within the capabilities of the chassis' six 2500W power supplies, but could prove problematic when it comes to rack power delivery.
As we've previously reported, on average most datacenter racks today are under 6kW of capacity, though 10kW and higher racks are becoming more common. Depending on your existing power infrastructure, a single 7081F could conceivably consume the entire rack power budget, unless modifications are made. ®
Get our [12]Tech Resources
[1] https://www.fortinet.com/blog/business-and-technology/fortigate-7081f-next-generation-firewall
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/energyefficientdatacenters&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZDd@ZdezsVQamdKCJ1D6oAAAANg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2022/10/11/fortinet_critical_flaw/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/energyefficientdatacenters&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZDd@ZdezsVQamdKCJ1D6oAAAANg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/energyefficientdatacenters&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZDd@ZdezsVQamdKCJ1D6oAAAANg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/energyefficientdatacenters&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZDd@ZdezsVQamdKCJ1D6oAAAANg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2023/04/12/cpu_power_management_feature/
[8] https://www.theregister.com/2023/04/12/gartner_are_clouds_greener/
[9] https://www.theregister.com/2023/04/11/cloud_dc_costs/
[10] https://www.theregister.com/2023/03/20/aws_wants_to_cook_its/
[11] https://docs.fortinet.com/document/fortigate-7000/hardware/fortigate-7081f-system-guide/423540/power-consumption-for-different-fim-7921f-fortigate-7081f-configurations
[12] https://whitepapers.theregister.com/
if you are pushing that much throughput
Nobody is going to blink at using 7kW of power, even if it means having to draw power from 2 racks.
Likely any such facility hosting such a piece of equipment with bandwidth needs in excess of 100Gbps will easily have enough power budget in a rack to run it, one thing to be careful of though would be to ensure the cabinet has 3 PDUs from 3 different sources of power/generators, and put two PSUs on each PDU. Technically with the specs you could draw 7kW on 3 PSUs on a single feed, but personally wouldn't feel comfortable pushing things to that kind of limit. Though likely real power draw will be far less than the peak, so probably doesn't matter.
I had one service provider several years ago go down at one site(not a site I was hosted at but still impacted the routing in the region), and it was due to a power outage, but more specifically whomever set up the equipment for whatever reason, had all of their core router PSUs hooked to the same UPS/generator(when the facility they were at had multiple). So clearly setup incorrectly and eventually bit them in the ass when that one feed went down, took out their core router(s). The whole facility didn't go dark just one set of feed(s).
They owned up to it quick after I drilled them, and committed to fixing it fast. Stupid mistake, but the provider has a 100% uptime SLA with their customers so not a mistake that should of ever happened.