How to Choose a FortiGate Firewall

Why the FortiGate Range Dominates the NGFW Market

According to IDC, Fortinet ranks #2 worldwide in the firewall market, with annual growth exceeding 30% for the past 5 years. Its advantage is not marketing—it is architectural. Fortinet is the only vendor that designs its own ASICs (NP7, CP9, SP5), providing hardware acceleration for firewall, IPS, VPN, SSL inspection, and SD-WAN. At the same price point, a FortiGate delivers 2 to 4× more threat protection throughput than a competing x86 firewall.

The FortiGate range extends from entry-level solutions for SMBs (FortiGate 40F at €450) to high-performance data center platforms (FortiGate 7000 series at €100K+). This guide will help you select the right model based on your number of users, bandwidth, and enabled security services.

The FortiGate Range: 12 Models You Should Know

Desktop / Small Branch (5-50 Users)

• FortiGate 40F (FG-40F): 5 Gbps FW / 600 Mbps Threat. 5 GbE ports. For 5-20 users. OPTINOC price: ~€450 excl. VAT. 1-year UTP license: ~€350.
• FortiGate 60F (FG-60F): 10 Gbps FW / 700 Mbps Threat. 7 GbE ports + 2 SFP. For 20-80 users. The worldwide best-seller. Price: ~€700 excl. VAT. UTP license: ~€550/year.
• FortiGate 80F (FG-80F): 10 Gbps FW / 1.4 Gbps Threat. 16 GbE ports + 2 SFP. For 50-150 users. Price: ~€1,600 excl. VAT.

Branch / Mid-Market Enterprise (100-1000 Users)

• FortiGate 100F (FG-100F): 11.5 Gbps FW / 1 Gbps Threat. 22 GbE ports + 2 SFP28. For 100-300 users. Price: ~€2,800 excl. VAT.
• FortiGate 200F (FG-200F): 27 Gbps FW / 3 Gbps Threat. 18 GbE ports + 8 SFP + 4 SFP+. For 300-1000 users. Price: ~€5,500 excl. VAT.
• FortiGate 400F (FG-400F): 37 Gbps FW / 5 Gbps Threat. 36 GbE ports + 4 SFP+ + 4 SFP28. For 500-1500 users. Price: ~€12,000 excl. VAT.

Data Center / Large Enterprise (1000-10000+ Users)

• FortiGate 600F (FG-600F): 36 Gbps FW / 5.6 Gbps Threat. 24 GbE ports + 16 SFP+ + 4 SFP28. For 1000-3000 users. Price: ~€16,000 excl. VAT.
• FortiGate 1800F (FG-1800F): 118 Gbps FW / 15 Gbps Threat. 16 SFP+ ports + 4 SFP28 + 2 QSFP28. For data centers. Price: ~€45,000 excl. VAT.
• FortiGate 3000-4000F: 200+ Gbps FW. Large data centers. Price: €80-150K.
• FortiGate 7000 series: modular chassis supporting up to 1 Tbps. Service providers / hyperscale environments. Price: €200K+.

Sizing: The Field-Proven Rule

Mistake #1: sizing based on raw firewall throughput. This figure is measured using 1518-byte UDP packets with no services enabled—a traffic profile that no real-world organization has. The correct metric is Threat Protection throughput, with IPS + AV + App Control enabled simultaneously.

• Formula: actual WAN bandwidth × 1.2 (20% headroom) = minimum required threat protection throughput.
• Example: 1 Gbps symmetric fiber → 1.2 Gbps threat protection required → FortiGate 100F (1 Gbps Threat) is only just sufficient, while FortiGate 200F (3 Gbps Threat) provides comfortable headroom.
• Add 50% headroom for traffic peaks, such as simultaneous Teams saturation and OneDrive downloads.
• Multi-site environments: the central hub should provide 3-5× the throughput of a branch because it aggregates incoming IPsec traffic.

FortiGuard Licenses: Which Bundle Should You Choose?

• UTP (Unified Threat Protection) bundle: IPS, Antivirus, App Control, Web Filter, Antispam, DNS Filter, and FortiCare 8×5. ~40-50% of the hardware price per year. Covers 90% of enterprise requirements. This is the default bundle.
• ATP (Advanced Threat Protection) bundle: everything in UTP + FortiSandbox cloud (zero-day analysis) + FortiCloud logging. ~55% of the hardware price per year. For organizations with a SOC.
• Enterprise bundle: everything in ATP + IoT Detection + OT Security + Inline CASB + DLP. ~75% of the hardware price per year. For regulated industries such as healthcare, financial services, and OT.
• ASE (Advanced Security): ATP + 24/7 SOC Services managed by Fortinet. For organizations without an internal SOC.

High Availability (HA Cluster)

Every mission-critical firewall should be deployed in an HA cluster. Losing a standalone firewall means an Internet outage and business disruption. Fortinet HA clusters support two modes:

• Active-Passive (A-P): one active firewall and one on standby. Failover in 1-3 seconds. Simple and reliable. Used in 95% of deployments.
• Active-Active (A-A): both firewalls process traffic simultaneously through load balancing. More complex, with double the throughput. For extreme performance requirements.
• Link: 2 dedicated ports between the firewalls for heartbeat + synchronization. Use the dedicated HA1/HA2 ports on 100F+ models.
• Cost: double the hardware budget and license the secondary unit. It is expensive, but it is essential in production environments.

VDOM: Native Multi-Tenancy

Virtual Domains (VDOMs) allow a physical FortiGate to be divided into multiple independent logical firewalls. Each VDOM has its own policies, routes, interfaces, and VPNs. Ideal for:

• MSSPs: a FortiGate 200F can serve 10-50 customers using separate VDOMs.
• Large enterprises: isolate the DMZ, production, administration, and OT environments on the same hardware.
• Compliance: PCI-DSS requires separation of the CDE—a dedicated VDOM meets this requirement.
• Limits: 10 VDOMs included on 200F+ models, expandable to 250 with an additional license.

SD-WAN Included as Standard

This is Fortinet's KEY differentiator: SD-WAN is integrated into FortiOS with no additional license. A FortiGate 60F provides both NGFW firewalling + SD-WAN at no extra cost. With Cisco, a Catalyst 8200 + Viptela license costs ~€6,000. With Fortinet, an all-inclusive FortiGate 60F costs ~€1,250 for the first year.

OPTINOC Recommendations by Customer Profile

• SMB with 10-30 users, 1 site, and 100-500 Mbps fiber: FortiGate 40F or 60F + UTP. Year 1 budget: €1,000-1,250.
• SMB with 30-100 users and 500 Mbps-1 Gbps fiber: FortiGate 60F or 100F HA cluster + UTP. Budget: €3,000-7,000.
• Mid-market enterprise with 100-500 users and multiple sites: FortiGate 100F at branch locations + central 200F HA cluster + FortiManager. Budget: €30-80K.
• Large enterprise with 500+ users: FortiGate 600F+ in the DC + FortiManager + FortiAnalyzer. ATP at a minimum. Budget: €100K+.

OPTINOC distributes the entire FortiGate range with the manufacturer's warranty and activated FortiGuard licenses. Initial configuration and HA deployment are available upon request. Delivery across Europe within 24-72h.