FortiGate is Fortinet's firewall product line. As a firewall, a FortiGate controls traffic between the internet, the corporate network and the cloud, accepts VPN connections and inspects content for attacks and malware. It is available as hardware for sites of different sizes, as a virtual machine and as a variant for cloud platforms.
How is a FortiGate built?
All variants run the FortiOS operating system. It provides firewall rules, routing, VPN, SD-WAN and management. Which inspections are active beyond plain rule evaluation depends on the FortiGuard subscriptions booked.
Hardware and subscription therefore need to be considered separately. The device belongs to the company. The security services run on a license with a fixed term that has to be renewed.
FortiGuard bundles
Fortinet groups the security services into bundles:
- Unified Threat Protection (UTP): intrusion prevention, detection of viruses, botnets and suspicious files via sandbox, web, video and DNS filtering, inline CASB for cloud applications and anti-spam. FortiCare Premium support is included.
- Enterprise Protection: all UTP services plus AI-based inline malware prevention, data loss prevention including for shadow AI, IoT security and security rating.
An example of the order of magnitude: a FortiGate 60F with one year of UTP cost €1,416.96 net at a German reseller. Prices depend on model, term and reseller.
What happens when FortiGuard expires?
The firewall keeps working, rules and VPN tunnels stay active. However, signatures for antivirus and intrusion prevention are no longer updated. Category-based web and DNS filtering stops. In the default setting, the FortiGate then blocks web traffic.
For operations this means: subscription terms belong in the same overview as certificates and maintenance contracts. A renewal should be ordered before the expiry date.
SSL VPN: moving to IPsec
Fortinet removed SSL VPN tunnel mode from FortiOS 7.6.3 onwards. The 50G, 70G and 90G models already have no SSL VPN from FortiOS 7.2.12 and 7.4.8 respectively. Anyone running remote access over SSL VPN should plan the move to IPsec VPN or to an approach based on zero trust.
The change affects clients, sign-in and multi-factor authentication. It should be tested with a pilot group before the firmware update so that remote access does not fail after the update.
FortiOS support periods
Fortinet supports FortiOS 7.4 until 11 November 2028 and FortiOS 7.6 until 25 January 2030. Firewalls are reachable from the internet and a frequent target of attacks. Firmware updates therefore belong in a structured patch management process, with a maintenance window and a fallback plan.
FortiGate and the cloud
A FortiGate at the company site is often the remote end for connections to the cloud, for example via site-to-site VPN to the Azure VPN Gateway. With a private connection via Azure ExpressRoute, it also remains the point where rules between the corporate network and the cloud apply. For administering servers in Azure, Azure Bastion is an alternative to RDP or SSH rules on the firewall.
FortiGate with TOMORIS
What TOMORIS takes on for setting up, operating and renewing FortiGate firewalls is described on the page Fortinet firewall and VPN. An overview of service and prices is available at FortiGate service and prices.