Fortinet FortiNDR 2500G
Network Detection and Response with Virtual Security Analyst

Overview:

Highlights:

FortiNDR Key Features

• On Premise solution where no data leaves the customer network
• Integrate with Fortinet Security Fabric including FortiGate/FortiNAC/FortiSwitch quarantine, FortiAnalyzer/FortiSIEM log and report
• Supports standalone, center, and sensor modes for distributed deployment
• Patented high throughput malware scanning based on Artificial Neural Networks (ANN) to identify file-based attacks, with over 20+ malware attack scenarios
• Reduce malware detection and investigation time from minutes to seconds
• Detect North/South/East/West intrusions accurately
• Detect botnets and weakciphers on network
• Virtual Security Analyst™ to mimic experienced security analyst for outbreak, anomalies, and root causes for malware infections
• Provide on-premises learning to reduce false positives by analyzing organizational-specific traffic and adapting to newly disguised threats

FortiNDR On Premise Solution:

FortiNDR On Premise SOC Deployment

Top Reasons for FortiNDR Solution

Shortage of Experienced SOC Analysts

Experience is the hardest thing to acquire in cybersecurity, especially in threat analysis, outbreak investigation, and malware research experience. FortiNDR provides Virtual Security Analyst™.

Breach Preventio

Using both ML and signature-based to identify breaches with high degree of confidence, including data enrichment on attacks.

AI-Powered Detection and Response for Cyber Attacks

Innovative threat actors disrupt cyber security through automated attacks designed to overwhelm or sneak past your SOC defenses.

ML-based Traffic Profiling and Malware Detection

Carefully crafted cyber threats designed to bypass your existing security controls through the camouflage with malware detection.

Features	FortiNDR On Premises
Deployment / Data Location	On Premise
Suitable Use	OT, Air-gapped, Large SOC
Centralized Management	Standalone, Center and Sensors mode (up to 20 sensors)
Sensors, Center, and Standalone Options	Sensor: FortiNDR-1000F, VM16 and VM32 Center Hardware: FortiNDR-3500F, FortiNDR VM for Central Management Standalone: FortiNDR-1000F, VM 16, VM32, and FortiNDR 3500F
Response Integration	FortiGate, FortiSwitch, FortiNAC quarantine, Third party API calls FortiAnalyzer, FortiSIEM, and FortiSOAR
Malware Detection	Antivirus engine and patented Artificial Neural Network (ANN)
Detections and Device Enrichment	Netflow Ingestion and AD Integration
Retention	Throughput and Disk Dependent

FortiNDR Advanced Malware Detection by ANN

Specifications:

	FortiNDR 1000F	FortiNDR 2500G	FortiNDR 3600G
Deployment
Sniffer / SPAN / 802.1q support			—
Deployment Mode	Standalone, Sensor	Standalone, Sensor	Center only
Sensors Managed*	—	—	up to 50
Fortinet Security Fabric Integration (such as FortiGate, FortiSandbox)1			—
Hypervisor Support	—	—	—
Netflow Support			—
Hardware Specifications
Form Factor	2 RU Rackmount	2 RU Rackmount	2 RU Rackmount
Total Interfaces	2x 10/100/1000 RJ45 ports, 4x 10G SFP+, 1x RJ45 console	1x GbE RJ45, 2x 10GbE SFP+, 4x 25GbE SFP28	1x 1GbE RJ-45 ports 4x 10GbE SFP+ ports
Sniffer/Capture Interfaces2	2 (2 x Fiber 10G SFP+)	4x 25GbE SFP28 (can operate in 10Gbps)	—
Transceivers Included	Purchase separately2	Purchase separately2	Purchase separately2
Storage Capacity	2x 7.68 TB (RAID 1) total 7.68 TB (RAID 1)	61.44TB (4x 15.36TB SSDs)	12x hot-swapple HDD (total 176TB)
Default RAID level (software RAID)	1	10	5
Removable Hard Drives
Redundant Hot Swap Power Supplies
Custom GPUs for ANN Acceleration	—	—
System Performance
NDR Sniffer Throughput
HTTP (single/dual port)	single 10/ dual ports 20 Gbps	34 Gbps (4 ports)	—
Enterprise Mix (single/dual port)	single 10/ dual ports 20 Gbps	34 Gbps (4 ports)	—
Malware Analysis Throughput (files per hour)2	100k	200k	—
Netflows (flows/second)	170k	252k	—
Malware Classification	26	26	26
Dimensions
Height x Width x Length (mm)	88.9 x 444.5 x 574.04	88 x 438 x 695.8 (w/o handle), 88 x 483 x 740.8 (w/ handle)	88 x 438 x 750
Weight	34.6 lbs (16 kg)	40 lbs (18.14kg)	75.12 lbs (34 kg)
Environment
AC Power Supply	100-240 VAC, 60-50 Hz	100-240 VAC, 60-50 Hz	200-240 VAC, 60-50 Hz
Power Consumption (Average / Maximum)	163 W (idle) / 345 W (full loading)	524.8W (idle) / 682.2W (full loading)	1046 W / 1359 W
Heat Dissipation	1207.5 BTU/h
Operating Temperature	0°C to 40°C (32°F to 104°F) with no direct sunlight on the equipment	0°C to 40°C (32°F to 104°F)	0°C to 40°C (32°F to 104°F)
Storage Temperature	–20°C to 70°C (–4°F to 158°F)	–20°C to 70°C (–4°F to 158°F)	–20°C to 70°C (–4°F to 158°F)
Humidity	Storage: 5% to 90% non-condensing	5% to 90% non-condensing	5% to 90% non-condensing
Operating Altitude	Up to 16,404 ft (5000 m)	10,000 ft (3048 m)	10,000 ft (3048 m)
Compliance
Safety Certifications	FCC Part 15 Class A, ICES, CE, RCM, VCCI, BSMI, UL/cUL, CB	FCC Part 15 Class A, RCM, VCCI, CE, UL/cUL, CB	FCC, ISED, RCM, VCCI, CE, BSMI, UL/cUL, CB

* For deployment more than 20 please consult Fortinet system engineers for details.
¹ For full list of Fortinet Fabric integration, please refer to Release Notes for details.
² If copper on FNR-1000F or FNR-3600G is required (e.g. for mgmt or sniffer), customer can use 1G with Fortinet FN-TRAN-GC.
If 10G copper is reqiured on FNR-1000F or FNR-3600G, customer will need to purchase E10GSFPT from https://www.fs.com/products/89577.html
Fortinet FN-TRAN-SFP+SR and FN-TRAN-SFP+LR are also supported on NDR-1000F and NDR-3600G platforms.
FN-TRAN-SFP28-LR and FN-TRAN-SFP28-SR can be used on FNR-2500G on 4x 25GB ports.
³ Combined real world throughput based on 10:1 Non-PE/PE files

Documentation:

Download the Fortinet Forti NDR Series Datasheet (PDF).