In short
In a Fortinet Security Fabric site, the FortiGate firewall manages FortiSwitch switches over FortiLink and FortiAP access points with its built-in wireless controller, which needs no extra licence. FortiManager or FortiManagement Cloud manage many sites. Forever Systems, a Fortinet Advocate Partner, can design, supply and install the whole stack.
Shop network hardware
Add products and licences to your basket, then check out when you are ready.
What the Security Fabric means for a site network
Fortinet uses "Security Fabric" for the way its products share management and threat information. On a typical office or branch network that comes down to three layers:
- FortiGate next-generation firewall at the edge: internet, VPN, SD-WAN and security services, and the controller for everything below it.
- FortiSwitch Ethernet switches, connected to the FortiGate firewall over FortiLink and configured from it: VLANs, PoE, port security and access control.
- FortiAP access points, plugged into the FortiSwitch switches and managed by the wireless controller built into the FortiGate firewall.
Fortinet: "FortiLink extends Security Fabric protection to the Ethernet access layer" (FortiSwitch page (opens in a new tab)).
FortiLink: switches managed from the FortiGate firewall
Fortinet's FortiSwitch Secure Access data sheet (opens in a new tab) describes FortiLink as "an innovative proprietary management protocol that enables seamless integration and management between a FortiGate Next-Generation Firewall and the FortiSwitch Ethernet switching platform". In practice:
- "All models can be managed and configured directly from the FortiGate", or standalone if you prefer.
- "FortiSwitch offers many features, including NAC, without additional licensing": basic network access control with no extra licence.
- VLANs, PoE and port policies are set on the FortiGate firewall and pushed to every managed switch.
Fortinet's FortiLink Guide (opens in a new tab) adds three points worth knowing before you buy:
- "FortiLink is not supported in transparent mode."
- "The maximum number of supported FortiSwitch units depends on the FortiGate model", from 8 on the FortiGate 40F upwards; the product matrix lists the limit for each model.
- FortiSwitchOS and FortiOS versions must match Fortinet's FortiLink Compatibility table, and "New models (NPI releases) might not support FortiLink" at first. We can check versions when we stage the equipment.
The built-in wireless controller
Fortinet's Wireless Product Matrix (opens in a new tab) says "The FortiGate Wireless Controller is built into all FortiGate models and does not require any additional licensing to use". FortiAP access points can also be managed from FortiGate VM, FortiSASE or FortiManagement Cloud (FortiAP page (opens in a new tab)).
Each FortiGate model has a maximum number of access points it can manage (total, and in tunnel mode). A FortiGate 30G manages up to 16, a 70G up to 96 and a 200G up to 256 (Fortinet Product Matrix, October 2026).
Not sure what you need?
Tell us about your sites and we will recommend the right kit and licences.
Central management for more than one site
- FortiManager (opens in a new tab): Fortinet says "FortiManager and FortiManager Cloud streamline and automate network and security management for the Fortinet Security Fabric", with "zero-touch provisioning with best-practice templates". It comes as a hardware appliance, a VM or the cloud service; see FortiManager and FortiAnalyzer.
- FortiAnalyzer (opens in a new tab): central logging and reporting across the fabric.
- FortiManagement Cloud (opens in a new tab) (formerly FortiEdge Cloud): Fortinet's SaaS console "unifying Fortinet firewalls, switches, access points, and cellular gateways in one intuitive dashboard", suited to smaller estates.
A single site can be run entirely from its FortiGate firewall; FortiManager or FortiManagement Cloud start to pay off when there are several sites to keep consistent.
Security Fabric requirements checklist
Before ordering, we can check:
- The FortiGate model: enough FortiSwitch and FortiAP capacity for the site, and threat protection throughput for the internet line.
- Firmware: FortiOS on the firewall and FortiSwitchOS on the switches at versions Fortinet lists as FortiLink-compatible.
- Firewall mode: FortiLink needs the FortiGate firewall in NAT (routed) mode, not transparent mode.
- PoE: enough budget on the FortiSwitch switches for the FortiAP access points (see the PoE budget guide).
- Licences: a FortiGuard bundle for the firewall; switch management and the wireless controller need no extra licence.
Example bill of materials for a small office
A typical small office on the Security Fabric, as it would go in your basket:
| Role | Example part number | What it does | Basket |
|---|---|---|---|
| Firewall and controller | FG-70G | FortiGate 70G: firewall, SD-WAN, VPN, FortiLink switch controller and wireless controller for up to 96 FortiAP access points and 24 FortiSwitch switches | |
| Access switch | FS-124F-FPOE | FortiSwitch 124F-FPOE: 24 ports, all 802.3af/at, 370 W PoE budget | |
| Wi-Fi 7 access points | FAP-231K-E | FortiAP 231K: Wi-Fi 7, 2x2, indoor (UK -E code) | |
| Security and support | FortiGuard bundle | UTP or Enterprise Protection for the FortiGate firewall, chosen when you add it | Chosen with the firewall |
Add more FortiAP access points and FortiSwitch switches as the site needs, up to the FortiGate model's limits. See the FortiSwitch and FortiAP ranges for other models.
Compare, then add to your basket
Every product in our shop lists its order codes and licences, ready to add.
How to order
How ordering works. Press Add next to a part number and it goes into your basket; where a subscription or support contract goes with the hardware, you choose it in the same step. Then View basket and Request a quote. We check every line, quantity and term against your sites and send back a personalised quote by email. Nothing is charged online. We can also design, supply, stage, install and configure the equipment, with the scope confirmed at quote (see network installation). We can stage the FortiGate firewall, switches and access points together so they arrive configured.
How we can help with your network
Forever Systems can design, supply, stage, install and configure the network around the hardware you buy here, as a project or one step at a time.
- Design: we look at your sites, users and existing kit and size the switches, wireless and firewalls to fit
- Supply: every order gets a personalised quote by part number, with the subscriptions and support each product needs
- Stage: we can pre-configure and label equipment before it reaches site
- Install: we can rack and mount switches, access points and firewalls on site
- Configure: VLANs, wireless, firewall policy, VPNs and management platforms set up and documented at handover
Scope is confirmed at quote, so you only pay for the parts of the project you need.
Frequently asked questions
What is the Fortinet Security Fabric?
Fortinet's name for its products working together as one platform, sharing management and threat information. On a site network, a FortiGate firewall manages FortiSwitch switches and FortiAP access points from one interface.
What is FortiLink?
Fortinet's proprietary management protocol between a FortiGate next-generation firewall and FortiSwitch switches, so the switches are configured and monitored from the firewall.
Does the FortiGate wireless controller need a licence?
No. Fortinet says the wireless controller is built into all FortiGate models and does not require any additional licensing.
How many FortiSwitch switches can a FortiGate firewall manage?
It depends on the model: 8 on the 30G, 40F and 50G, 24 on the 60F to 90G, 48 on the 120G and 64 on the 200G, rising on larger models (Fortinet Product Matrix, October 2026).
What are the Security Fabric requirements?
A FortiGate firewall in NAT mode, FortiSwitchOS and FortiOS versions on Fortinet's FortiLink compatibility list, and a model with enough switch and access point capacity. We check these when we quote and stage.
Ready to order?
Build your basket and check out when you are ready.