The FortiGate range is long and datasheets are full of numbers that mean little to a small office. The most common mistake is to pick a model by the biggest “Firewall throughput” figure and discover later that the internet is slow once security features are on. Here is a checklist for choosing a unit that will last several years.
What matters
- Internet speed – what you have now and what you are likely to get. With a 1 Gbit/s line, the unit must pass that speed with all security features enabled.
- Users and devices – count phones, printers, cameras and guest devices too. There are usually 2–3 times more devices than people.
- VPN – how many people work from home, and whether offices are linked. Bear in mind that SSL VPN is being removed in FortiOS 7.6 and Fortinet recommends moving remote access to IPsec VPN (IKEv2) with FortiClient; SSL VPN disappeared first on entry models with 2 GB of RAM. For a new unit, plan for IPsec VPN from the start.
- Ports and PoE – how many LAN ports you need, whether you need two WAN ports (two internet lines), an SFP port for fibre or PoE to power phones and access points. Adding a FortiSwitch is often better than hunting for a FortiGate with more ports.
- Built-in Wi-Fi – FortiWiFi models suit a very small space. In a larger office a FortiGate with separate FortiAPs is better, because a firewall in the server room will not cover the whole floor.
- Desktop or rackmount – entry models are desktop units; if you have a server rack, check that a rack-mount kit exists for the model or choose a rackmount model.
- High availability (HA) – if the office cannot work without internet, consider two identical units in an HA cluster. Remember that both need licences.
- Headroom for 3–5 years – firewalls are replaced rarely. Choose a model that will still cope when headcount grows and the line gets faster.
How to read datasheet numbers
| Figure | What it means |
|---|---|
| Firewall throughput | Packet forwarding only, with no content inspection, in ideal lab conditions. The biggest number and the least meaningful in real use. |
| IPS throughput | Speed with intrusion prevention (IPS) only. |
| NGFW throughput | Firewall + IPS + application control. |
| Threat Protection throughput | Firewall + IPS + application control + malware protection. The most important number for a small office. |
| SSL Inspection throughput | Decrypting and inspecting encrypted traffic. The most demanding; relevant if you use deep inspection. |
| IPsec VPN throughput | VPN tunnel speed, relevant for site-to-site links. |
Rule of thumb: the Threat Protection figure should be clearly higher than your internet speed, to leave headroom. If you plan SSL deep inspection, look at the SSL Inspection figure as well.
Entry models in brief
Desktop units aimed at small offices include the 40F, 50G, 60F, 70G and 90G series. The higher the number, the more performance, ports and memory. The 40F and 50G suit a very small office with a slower line; the 60F and 70G are a common choice for a typical office of 10–30 people; the 90G gives more headroom for a fast line, more devices or SSL inspection. Many have a Wi-Fi variant (FortiWiFi). Always check exact performance figures on the current datasheet of the specific model, as they depend on the model and firmware.
Licences and total cost
Without a licence a FortiGate can work as a basic firewall, but without firmware updates and current security signatures. Units are usually bought with a bundle:
- FortiCare – support, firmware updates and hardware replacement (RMA);
- UTP (Unified Threat Protection) – adds IPS, antivirus, web filtering and more; the most common choice for a small office;
- ATP (Advanced Threat Protection) – a narrower bundle focused on threat protection; Enterprise Protection – broader than UTP, for organisations with stricter requirements.
Compare the total cost over 3–5 years: the unit plus the licence for the whole term. A multi-year bundle is usually cheaper per year, and a bigger model’s licence costs more – another reason not to buy an oversized unit.
When to call a professional
If you have several offices, two internet lines, an HA requirement or strict security requirements, choose the model with a specialist who can also review your current traffic. You can browse models and licences on the FortiGate page; for advice call ITABIKS on +372 53 888 229.