FortiGuard bundles: ATP vs UTP vs Enterprise Protection

ATP vs UTP vs Enterprise Protection

Fortinet describes the three bundles like this on its NGFW page (opens in a new tab) and security bundles page (opens in a new tab):

• Advanced Threat Protection (ATP): "Foundational security services including: IPS, antivirus, FortiSandbox SaaS, application control, and inline CASB."
• Unified Threat Protection (UTP): "Everything in ATP + URL/DNS filtering, video filtering, and anti-botnet/C2 communication services."
• Enterprise Protection (ENT): "Includes ATP and UTP", adding "DLP, attack surface security monitoring and risk scoring, AI-based inline malware prevention, and IoT detection and vulnerability correlation". Fortinet says "Enterprise Protection (ENT) is the only bundle that controls how employees use generative AI".

What each bundle includes, from those pages and the bundle part-number descriptions:

Fortinet lists application control and inline CASB as "included with FortiCare Subscription", so they come with support as well as with every bundle. OT environments need the separate OT Security Service: Fortinet says ENT does not include "OT-specific device and protocol recognition".

Which bundle to choose

• UTP is the usual choice for an office firewall: it adds web filtering, which most businesses want for safe browsing and policy.
• ATP suits a firewall where web filtering is not needed, for example between internal networks or at a site whose web traffic is filtered elsewhere.
• Enterprise Protection suits businesses that want data loss prevention, control over generative AI use, IoT visibility or Security Rating reports.
• SD-WAN bundle suits networks with several sites that use FortiGate SD-WAN across more than one internet line; it can sit alongside a security bundle.

Fortinet's security bundles page now leads with UTP and Enterprise Protection; ATP is still listed in every current FortiGate data sheet and in the part numbers below.

Model notes that change the choice

Some services are not available on every model. Fortinet's data sheets say:

• "Content Disarm and Reconstruct, DNS and Video Filtering, and Inline CASB are not available for FortiGate/FortiWiFi 30G and 50G series in any OS build."
• The same features are "not available for FortiGate/FortiWiFi 40F, 60E, 60F, 80E, and 90E series from 7.4.4 onwards."

On those models UTP still adds URL (web) filtering. If you need DNS or video filtering, look at the FortiGate 70G or larger, and check the feature notes on each model's page.

The SD-WAN bundle

The SD-WAN Service Bundle covers FortiGate SD-WAN monitoring and orchestration. Fortinet's part-number description for the FortiGate 70G lists "SD-WAN Underlay & Application Monitoring, Overlay Orchestration, FortiSASE 5-user starter kit, SASE Secure Private Access (SPA) Connector, FortiGuard SD-WAN SLA Database Updates, FortiTelemetry Cloud, IoT Security, Security Rating, 1-Year Cloud Log Retention, and FortiCare Premium".

Fortinet's data sheets note that the FortiSASE starter kit is "Only supported on FortiGate/FortiWiFi models from the 70F ... and FGR-60G onwards". A second SD-WAN code without FortiCare is for firewalls that already have a support contract.

How the part numbers work

FortiGuard and FortiCare codes follow one pattern: FC-10-[model code]-[service code]-02-[term]. The model code identifies the FortiGate model (for example GT70G for the FortiGate 70G and G70GP for the 70G-POE), and the term is 12, 36 or 60 months. The service codes in Fortinet's current ordering list:

Each FortiGate model has its own codes, so a bundle for a 60F cannot be applied to a 70G. Every model page on this site lists its own codes, and the basket asks for the bundle when you add the firewall.

Example: bundle and support codes for the FortiGate 70G

The codes for one model, so you can see the pattern. For any other model, add the firewall from its page and choose the bundle in the same step:

FortiCare support tiers

Fortinet offers three FortiCare tiers. These are Fortinet's own service levels, delivered by Fortinet, as set out in its FortiCare services brief (opens in a new tab):

Fortinet says "All bundles include FortiCare Premium Services". Elite can be added to a bundle with the Premium-to-Elite upgrade code. Fortinet's brief lists advance-replacement RMA with Premium and Elite.

Hardware and bundle in one part number

Fortinet also sells many FortiGate models as hardware plus a bundle under one code: -BDL-950 codes are the hardware with FortiCare Premium and Unified Threat Protection, and -BDL-809 codes the hardware with FortiCare Premium and Enterprise Protection, each for 1, 3 or 5 years. They are listed on each FortiGate model page. For a high availability pair, Fortinet's -HA hardware codes "must be bought in pairs and entitle HA pair to leverage single service contracts (limited to Enterprise, UTP, and ATP bundles only)".

Renewing FortiGuard or FortiCare

When a bundle or FortiCare contract on an installed FortiGate firewall is due to end, the renewal uses the same codes for that model and a 1, 3 or 5-year term. To quote it we need:

• the model and serial number (shown in FortiOS and on Fortinet's support portal)
• the bundle or support tier you have now, and whether to keep, upgrade or add services
• the end date of the current contract

Contact us for a renewal quote. It is also a good moment to check the model: if Fortinet has announced end of order for it, see Fortinet end of life and we can quote a replacement and its bundle side by side.

How to order

How ordering works. Press Add next to a part number and it goes into your basket; where a subscription or support contract goes with the hardware, you choose it in the same step. Then View basket and Request a quote. We check every line, quantity and term against your sites and send back a personalised quote by email. Nothing is charged online. We can also design, supply, stage, install and configure the equipment, with the scope confirmed at quote (see network installation).