Fortinet FortiGate

What Is Fortinet FortiGate?

When you need to control traffic between networks, connect remote users, and still run real security inspection (not just basic port blocking), “a firewall” stops being a simple box and becomes part of your security architecture. That’s the gap FortiGate is built to fill: it’s a next-generation firewall platform that can terminate VPNs, enforce policy at multiple layers, and integrate with Fortinet’s broader “Security Fabric” tooling.

FortiGate fits organizations that want one enforcement point for perimeter security, site-to-site connectivity, and (in many deployments) remote access. It’s commonly deployed as a physical appliance, but also exists in virtualized forms and consumption models (including FortiGate-as-a-Service).

What makes it distinctive in practice is the FortiOS software stack plus FortiGuard security services and subscription bundles. Fortinet sells the firewall platform, then layers support (FortiCare) and security subscriptions (FortiGuard) as add-ons or bundles (UTP/ATP/ENT, plus a-la-carte options).

Fortinet FortiGate Features and Performance

FortiGate’s VPN story is split between standards-based VPNs (IPsec) and TLS-based remote access options that Fortinet historically branded as “SSL VPN.” For this review, VPNSpotter’s verified protocol list is: IPsec, SSL VPN, and TLS. Those are consistent with Fortinet’s own documentation for FortiGate remote access: FortiGate supports IPsec and SSL VPN, and SSL VPN runs over HTTPS/TLS.

A key “no BS” point: SSL VPN availability depends on model and FortiOS version. Fortinet’s own community technical tip notes that SSL VPN can be present on some versions and then not available in later firmware releases for certain models (and calls out version-specific examples). If you’re buying FortiGate specifically for SSL VPN, you must validate your exact hardware platform and FortiOS release plan.

For secure remote access, Fortinet positions FortiClient as the endpoint client that can form VPN tunnels (including IPsec and SSL VPN) and can also be used for ZTNA-style access. Fortinet’s documentation explicitly says the “standalone FortiClient VPN client is free to use” and can accommodate SSL VPN and IPsec VPN tunnels.

On the security inspection side, FortiGate’s “NGFW” capabilities are tightly coupled to FortiGuard services (IPS, application control, web filtering, and related cloud-delivered intelligence). Fortinet publishes a FortiGuard Security Services datasheet describing services like IPS and application control and positioning them as cloud-delivered, AI-driven protection. In plain English: the box can do plenty on its own, but most buyers expect to pay for subscriptions if they want continuously updated threat intel and category databases.

Architecture-wise, Fortinet markets Security Fabric integration (FortiGate + FortiManager + FortiAnalyzer + endpoint agents, etc.). Even FortiGate-as-a-Service is explicitly packaged with FortiManager and FortiAnalyzer “as-a-Service,” plus FortiGuard security services. That signals the intended design: central management + central analytics/logging + firewall enforcement.

Performance is model-dependent and Fortinet publishes performance specs per appliance line, but there isn’t one universal “FortiGate speed” you can quote honestly. Fortinet’s Secure SD-WAN materials emphasize that some FortiGate appliances use purpose-built ASICs and claim these designs help with SSL/certificate inspection while minimizing performance impact. Treat this as vendor positioning rather than a benchmark; the real world will depend on feature mix (IPS/AV, SSL deep inspection), logging, and hardware sizing.

Pricing and Plans

FortiGate pricing is not a single SaaS-style number. It’s typically a combination of:

• The platform form factor (hardware appliance, virtual appliance, or managed/hosted offering like FortiGate-as-a-Service). Fortinet’s FGaaS page describes a package that includes a FortiGate hardware appliance plus FortiManager and FortiAnalyzer as-a-Service.
• Support (FortiCare): Fortinet’s ordering guide and reseller price lists commonly refer to FortiCare tiers (for example, “FortiCare Premium”).
• Security subscriptions (FortiGuard): Fortinet explicitly offers a-la-carte subscriptions or bundles. The official bundle lineup includes ENT, UTP, and ATP bundles (names and positioning are described on Fortinet’s security bundles page and in their ordering guide).
• Term length: subscriptions are commonly sold in 1-year and multi-year terms (the ordering guide is structured around subscriptions and bundles; reseller listings commonly show 1-year and 3-year subscription renewals for FortiGate-VM SKUs).

Exact end-user pricing varies heavily by model, region, and reseller, and Fortinet often sells through channel partners. Public reseller listings exist (for example, CDW listings for FortiGate-VM subscription renewal SKUs), but those are SKU-specific and not a universal price you can generalize across the line.

Free tier: Fortinet publicly states that some behavior differs for devices “without FortiGate Cloud subscription (Free Tier),” which implies a FortiGate Cloud free tier exists in at least some form. This is about cloud management/logging services, not “a free FortiGate firewall.”

Refunds: Fortinet’s public-facing pages we reviewed here do not provide a clear, universal refund window for FortiGate purchases/subscriptions. FortiGate is often sold via partners and under enterprise contracts, so refund terms are usually contract/reseller-dependent. (If your purchasing team cares about refunds, get it in writing from the reseller/contract.)

Privacy and Security Assessment

Jurisdiction: VPNSpotter’s verified data says Fortinet FortiGate is under United States jurisdiction (incorporated in Delaware). For buyers, the real implication is not “privacy” in the consumer VPN sense; it’s compliance, procurement, and legal environment. US jurisdiction may matter for regulated environments and government procurement, and it may also matter for buyers with strict data residency expectations when using Fortinet cloud services.

Telemetry and logs: Fortinet publishes a “Data Privacy Practices” datasheet that explicitly mentions “logs and telemetry data from Fortinet products enabled by customer,” and it distinguishes behavior for devices without a FortiGate Cloud subscription (Free Tier). Bottom line: FortiGate can generate a lot of logs, and optional cloud services and telemetry exist. In most enterprise deployments, logging is a feature, not a privacy drawback—but it does mean you should treat log retention, destinations, and access control as part of your security model.

Certifications and assurance: Fortinet maintains a Common Criteria certifications page listing FortiGate/FortiOS certifications (including FortiOS 7.2 and other versions) and also discusses evaluation levels (EAL4+ for certain FortiGate/FortiOS targets). Common Criteria isn’t a magic security stamp, but it is relevant for government and compliance-driven buyers.

Fortinet also publishes a FIPS 140-2/140-3 certification overview page and describes the transition to FIPS 140-3 and what the levels mean. Note that FIPS validation is about cryptographic modules under specific builds/configurations; it does not mean every FortiGate firmware build is automatically “FIPS validated.”

Security incidents and patching reality: Like any widely deployed perimeter device class, FortiGate and related remote access components have had high-impact vulnerabilities over the years. Fortinet runs a PSIRT program and publishes advisories, and it also publishes PSIRT blogs discussing observed exploitation and post-exploitation techniques in the field (including a June 19, 2026 PSIRT blog addressing reported credential compromise/abuse patterns for FortiGate devices and guidance for admins). The existence of a mature PSIRT function is good; the need to stay current on patches is non-negotiable.

Independent reporting and government advisories have also highlighted exploited vulnerabilities in Fortinet products and urged patching (for example, CERT-EU summaries referencing Fortinet advisories and exploitation-in-the-wild claims). Treat this as the normal risk profile of internet-exposed network security appliances: if you expose management or remote access to the internet and you don’t patch fast, you will eventually have a bad day.

Open-source posture: FortiOS/FortiGate is not positioned as an open-source firewall platform. If your security program requires source-available or independently buildable components, FortiGate generally isn’t aimed at that niche.

Strengths and Limitations

Strengths

• Strong ecosystem model: firewall + centralized management/logging + security subscriptions (FortiGuard bundles, FortiManager/FortiAnalyzer integrations).
• Mature remote-access options, including IPsec and SSL VPN support in many configurations; FortiClient VPN client is explicitly documented as free for basic VPN use.
• Enterprise/compliance alignment via published certification programs (Common Criteria listings; FIPS program overview and resources).

Limitations / trade-offs

• SSL VPN feature volatility by model/firmware: official Fortinet guidance shows cases where SSL VPN is available in some versions and then not in later versions for certain models. Plan migrations and confirm requirements before upgrades.
• Pricing is structurally complex: hardware/VM + support + security bundles, often via resellers, with SKU-specific costs that are hard to compare apples-to-apples.
• Operating an internet-exposed edge device requires disciplined patching and security hygiene; Fortinet’s own PSIRT communications and external advisories show real exploitation pressure over time.

Who Should Use Fortinet FortiGate?

Good fit

1. SMB to enterprise teams standardizing on Fortinet: If you want a single vendor story (FortiGate + FortiManager + FortiAnalyzer + FortiGuard subscriptions), Fortinet is explicitly built for that lifecycle.

2. Organizations that need standards-based VPN options: If IPsec site-to-site and remote access VPN are on your requirements list, FortiGate supports IPsec and (in many configurations) SSL VPN, with FortiClient as the endpoint client.

3. Compliance-driven buyers: If procurement asks about Common Criteria or FIPS-related posture, Fortinet publishes certification resources and Common Criteria certification listings for FortiGate/FortiOS versions.

Not a great fit

1. People who want a simple consumer VPN: FortiGate is an enterprise firewall platform. If your goal is “hide my IP” or “a streaming VPN,” you’re looking at the wrong product category.

2. Teams that depend on SSL VPN long-term without flexibility: Fortinet’s own community guidance shows SSL VPN availability can change across firmware versions/models. If your architecture can’t tolerate that uncertainty, prioritize IPsec or a ZTNA design instead of anchoring on SSL VPN.

3. Organizations that require open-source firewalls for transparency: FortiGate is a commercial, closed-source platform with subscription services. If open-source is a hard requirement, look elsewhere.