FortiGate next-generation firewalls

What is a FortiGate firewall?

A FortiGate next-generation firewall sits between your network and the internet and decides what may pass. Beyond allowing and blocking traffic, it recognises applications, inspects traffic for intrusions and malware, filters websites, and runs site-to-site and remote-access VPNs. Fortinet describes the range as "Built on patented Fortinet security processors", with "Integrated SD-WAN" and "Built-in ZTNA capabilities", across a "Flexible and rich portfolio with Wi-Fi, LTE, PoE, DSL, bypass, ruggedized models".

Every model runs the same operating system, FortiOS, so the features are the same from the smallest desktop unit to the larger rack-mount appliances; what changes is how much traffic each one can inspect, the number and speed of its ports, and how many switches and access points it can manage.

How a Fortinet firewall works

• Policies: you write rules for which users, devices and applications may reach which networks and services. FortiOS applies them to every session.
• Inspection: with a FortiGuard subscription, the firewall checks traffic against intrusion prevention signatures, antivirus, web and DNS categories and application signatures that Fortinet keeps up to date.
• Security processors: Fortinet designs its own chips, which take the heavy lifting off the main processor, which is how Fortinet gets high inspection throughput from small desktop units.
• SD-WAN: two or more internet lines (fibre, broadband, 4G or 5G) are used together, with traffic steered to the healthiest line.
• Fabric controller: the same box runs FortiSwitch switches over FortiLink and FortiAP access points with its built-in wireless controller.

The security services are what turn the hardware into a next-generation firewall, so each FortiGate firewall is bought with a FortiGuard bundle.

FortiGate models at a glance

Groups are as Fortinet lists them in its current models table. Throughput, session and capacity figures for every model are on the FortiGate product matrix, and each model page has its own specification table. High-End models from the 1000F upwards are quoted on request.

Choosing a FortiGate firewall

Size on the Fortinet threat protection figure, which is measured with firewall, IPS, application control and malware protection on, then add headroom for faster lines and HTTPS inspection. The small business firewall guide walks through it.

FortiWiFi, SSD and HA part numbers

• FortiWiFi models (FWF-) add a built-in Wi-Fi radio, so a small office can run its firewall and Wi-Fi in one box. UK part numbers end -E, the Fortinet regional code for the United Kingdom, and Fortinet notes the region cannot be changed on the unit.
• The x1 models (31G, 51G, 61F, 71G, 81F, 91G, 121G, 201G, 401F, 401G, 701G and 901G) add onboard SSD storage, from 30 GB on the 31G to 960 GB on the 401G in Fortinet descriptions, for logs and reports kept on the firewall.
• HA codes (-HA) on several desktop models are sold in pairs; Fortinet says they "must be bought in pairs and entitle HA pair to leverage single service contracts (limited to Enterprise, UTP, and ATP bundles only)".

What you buy with a FortiGate firewall

• A FortiGuard bundle, for 1, 3 or 5 years. ATP (Advanced Threat Protection) is "IPS, Advanced Malware Protection Service, Application Control, and FortiCare Premium" in the Fortinet part-number descriptions.
• UTP (Unified Threat Protection): everything in ATP, plus "URL filtering, Secure DNS filtering, Video Filtering, anti-spam, malicious certificate inspection, and the dynamic anti-botnet & C2 service", on the Fortinet bundles page.
• ENT (Enterprise Protection): "UTP, plus advanced Data Loss Prevention (DLP) for Shadow AI governance, Attack Surface Security Rating, AI-based Inline Malware Prevention and IoT Security", on the same page.
• SD-WAN Service Bundle: SD-WAN underlay and application monitoring, overlay orchestration, SD-WAN SLA database updates and cloud log retention, in the Fortinet part-number descriptions.
• FortiCare support: Fortinet lists FortiCare Premium as included with its bundles; FortiCare is also sold on its own as Essential (desktop models only), Premium or Elite.
• Or one part number for both: -BDL-950 codes combine the hardware with FortiCare Premium and UTP; -BDL-809 codes with FortiCare Premium and ENT.
• Accessories: rack trays and kits, power supplies, SFP and SFP+ transceivers, and FortiToken hardware tokens for MFA, listed on each model page.

Compare the bundles on FortiGuard bundles.

Management and the Security Fabric

Each FortiGate firewall is managed from its own FortiOS web interface, from FortiManager for many sites, or from FortiManagement Cloud. It also runs FortiSwitch switches and FortiAP access points, so switching, Wi-Fi and firewall policy are set in one place; Security Fabric explains how. For 5G or LTE links, add a FortiExtender gateway.

End of order and replacements

Fortinet has announced end of order for some part numbers on these pages, including the FG-60F and FG-61F (their HA pair codes are still current), the FG-80F-POE and the FG-400F and FG-401F; each range page says which. The FortiGate 100F no longer appears in the current Fortinet models table, and the FortiGate 120G sits in its place. Lifecycle notes for older models are on Fortinet end of life.

FortiGate or WatchGuard?

Both are next-generation firewall ranges with desktop and rack-mount models and security subscriptions. FortiGate firewalls also manage Fortinet switches and access points over FortiLink; WatchGuard Firebox appliances are managed in WatchGuard Cloud with WatchGuard access points. The side-by-side comparison, with Cisco as a third column, is on Fortinet vs WatchGuard.

How to order a FortiGate firewall

How ordering works. Press Add next to a part number and it goes into your basket; where the hardware needs a subscription or support term, you pick it in the same step. Add any accessories, then View basket and Request a quote. We check every line, quantity and term against your sites and come back with a personalised quote by email. Nothing is charged online. We can also design, supply, stage, install and configure the network as a project, with the scope confirmed at quote (see network installation).

Not sure which model fits? Contact us with your users, internet lines and the security services you want to run.