FortiGate

Why do you need FortiGate?

A firewall is one of the few cybersecurity components that sees all of an organization’s traffic — which is exactly why its configuration ages faster than the hardware. The platform decision should weigh not only throughput, but also who will be reviewing the rules three years from now.

Every extra device in the traffic path is another rule set somebody will have to understand years from now. Separate devices mean more consoles and exceptions, and inspecting encrypted traffic puts the heaviest load on a firewall.

FortiGate is Fortinet’s family of next-generation firewalls. Inspection is handled by dedicated SPU chips that offload the general-purpose CPU — so SSL inspection does not have to be the first feature switched off when traffic grows. SD-WAN and ZTNA are functions of the same FortiOS system, so they do not require separate devices at the network edge.

How does it work?

Security Processing Units (SPU)

Fortinet’s dedicated chips:

• Network processors (NP) - accelerate stateful firewalling, IPsec and address translation
• Content processors (CP) - take over application identification, IPS and antivirus
• SP chips - combine both functions on a single chip
• Inspection on dedicated silicon instead of on the general-purpose CPU alone

FortiGuard AI Security Services

Subscriptions fed by FortiGuard Labs threat intelligence:

• IPS with virtual patches for newly disclosed vulnerabilities
• Antivirus, web and DNS filtering, application control
• AI-based detection of unknown malware in the traffic path

FortiOS

A common operating system for the whole family:

• The same FortiOS on appliances, virtual machines and in the cloud
• Firewall, SD-WAN and ZTNA in one system
• REST API, CLI, plus Ansible and Terraform integrations
• Central management with FortiManager

Key Features

Next-Gen Firewall

• Stateful inspection
• Application control based on thousands of signatures
• Full SSL/TLS inspection, including TLS 1.3
• Identity-based policies

Integrated SD-WAN

• Application-based traffic steering
• Multiple WAN links with automatic failover
• WAN path controller
• Link quality measurement (latency, jitter, packet loss)

Universal ZTNA

• Zero Trust Network Access
• With the FortiClient agent or agentless
• Checks on every application access
• Access through a proxy portal

Threat Prevention

• IPS with virtual patching
• Antimalware
• Sandboxing (FortiSandbox)
• Anti-bot and DNS filtering

FortiGate Portfolio

Entry-Level: branch offices and smaller sites; variants with Wi-Fi, LTE and PoE

Mid-Range: campuses and headquarters

High-End: data centers and high volumes of encrypted traffic

Virtual (FortiGate-VM): AWS, Azure, Google Cloud, Oracle Cloud, VMware ESXi, Hyper-V, KVM

Rugged: OT/ICS, industrial conditions

Who is it for?

• Organizations combining security and networking on one platform
• Multi-site companies deploying SD-WAN and ZTNA
• OT/ICS environments in manufacturing and energy
• Mid-sized companies with a small IT team that want a single console

Benefits

For IT: One device for firewall, SD-WAN, ZTNA. Central management with FortiManager

For security: FortiGuard services fed by continuous threat analysis, hardware-assisted SSL inspection

For business: fewer devices through consolidation, one renewal cycle, vendor support through FortiCare

Specifications

Form factors	Hardware appliances, FortiGate-VM, rugged models
SSL inspection	Hardware-assisted (content processors)
SD-WAN	Integrated
Management	FortiManager, FortiCloud

When does FortiGate make sense for your organization?

The FortiGate family covers appliances from the branch office to the data center, virtual machines and industrial models, and all of them run the same FortiOS. That common foundation is the strongest argument wherever there is more than one firewall. Three typical situations:

A mid-sized company with a small IT team

In an organization where security is handled by two or three administrators alongside other duties, every additional console is a real cost. FortiGate can act as the firewall, the SD-WAN gateway and the ZTNA access point, and the controller built into FortiOS also manages FortiSwitch switches and FortiAP access points. Instead of several products with separate rule sets, the team maintains one policy and one place where traffic is visible. If the current firewall is approaching the end of its life cycle, the replacement is a good moment to bring these functions onto one platform and clean up the rules along the way.

Plants, substations and OT networks

In manufacturing and energy, the network is often spread across production halls, substations and remote sites, and the devices must withstand industrial conditions. IT/OT segmentation starts with dividing the network into zones and allowing between them only the traffic the installation needs to operate. Fortinet offers rugged models designed for such locations, and the FortiGuard OT Security service adds industrial protocol decoding and virtual patches for OT devices. Because all sites run the same FortiOS, segmentation policies can be designed and maintained centrally in FortiManager.

Finance: branches, headquarters and cloud

Banks and insurers connect a branch network, a data center and cloud services. FortiGate-VM lets you apply the same rules in AWS, Azure, Google Cloud or on local virtualization, while branch appliances combine the firewall with Secure SD-WAN. Where a branch has no administrator of its own, a new appliance can be brought online without on-site configuration (zero-touch). Central management and user identity-based policies make it easier to show an auditor who accessed which systems and from where.

Which of these situations is yours becomes clear from an inventory of your current devices, links and rules.

What should you do when a FortiGate approaches End-of-Service?

Every FortiGate model has a life cycle defined by the vendor. Fortinet describes it with three dates:

• End of Order (EOO) — according to Fortinet, the last day on which the product can be ordered; the vendor announces it at least 90 days in advance with an End of Life (EOL) notification.
• Last Service Extension Date (LSED) — according to Fortinet, the last day on which an extension of a support contract or a security subscription can be ordered; it falls 12 months before EOS.
• End of Support (EOS) — according to Fortinet, the final stage of the life cycle: after this date the vendor does not sell, manufacture or improve the product and is under no obligation to provide support services. For hardware, EOS generally falls 60 months after EOO.

What matters most for security is that, according to Fortinet, no service contract can be extended past the EOS date. A firewall that carries all of an organization’s traffic is then left without guaranteed vendor support and without the option to renew the subscriptions that IPS, antivirus and web filtering rely on. The real decision deadline is therefore the LSED, not the EOS itself.

You can check the status of a specific model on the public product life cycle list that Fortinet publishes on its support portal — according to the vendor, without logging in, with separate tabs for hardware and virtual machines, software and services.

The replacement plan we prepare at nFlo has six steps:

1. Inventory — models, FortiOS versions and life cycle dates of every device, including branches and spare hardware.
2. Rule review — which rules, objects and VPN tunnels are in use, and which are not worth migrating.
3. Choosing the successor — based on throughput with protection and SSL inspection enabled and on SD-WAN and ZTNA plans, not on the specifications of the old model.
4. Configuration migration — moving the configuration and adapting it to the new model and current FortiOS.
5. Parallel operation and cutover — testing on the new appliance, cutover in an agreed maintenance window and a rollback plan.
6. Verification — checking traffic, logs and policies after cutover and updating the documentation.

We run the replacement as part of our Firewall Implementation service.

Why deploy FortiGate with nFlo?

In a FortiGate project, the nFlo team:

• inventories devices, links, rules and hardware life cycle dates,
• designs zones, identity-based policies, SD-WAN for branches and the scope of SSL inspection,
• deploys and migrates the configuration with parallel operation and a rollback plan,
• maintains the platform: rule reviews, FortiOS updates and ticket handling.

Firewalls are covered by our Firewall Implementation service, branch connectivity by our SD-WAN service. To start a conversation about your current infrastructure, use the contact page; you can read about how nFlo works with the vendor on the Fortinet page.

FAQ

What are the SPU chips in FortiGate for? They take part of the work off the main CPU: network processors handle network functions and stateful firewalling, content processors handle application identification, IPS and antivirus.

Does SD-WAN run on the same appliance as the firewall? Yes. SD-WAN is a FortiOS function and runs on the same FortiGate. FortiGuard security services are purchased separately as subscriptions.

How does licensing work? The appliance (or a FortiGate-VM license) plus FortiGuard subscriptions: individual services or the ATP, UTP and ENT bundles.

Does FortiGate support ZTNA? Yes. Universal ZTNA is built into FortiOS. It works with the FortiClient agent or agentless, through a proxy portal.

Which models suit branch offices? Entry-Level models, which combine NGFW and Secure SD-WAN in one appliance, including variants with Wi-Fi, LTE and PoE.

Are virtual versions available? Yes. FortiGate-VM runs in AWS, Azure, Google Cloud and Oracle Cloud and on VMware ESXi, Hyper-V and KVM. In public clouds you can bring your own license (BYOL) or pay as you go.

How does SSL inspection work? You can choose certificate-only inspection or full SSL inspection, including TLS 1.3, hardware-assisted by content processors.

Does FortiGate integrate with other Fortinet products? Yes. Security Fabric - native integration with FortiManager, FortiAnalyzer, FortiSwitch, FortiAP.

How does multi-FortiGate management work? FortiManager for on-premise, FortiCloud for cloud. API, Ansible, Terraform for automation.

How do I know when support for my FortiGate ends? From Fortinet’s public product life cycle list on its support portal: it lists the End of Order, Last Service Extension Date and End of Support dates, and changes are also published in an RSS feed.

Can a FortiGate still be covered by support after End-of-Service? No. According to Fortinet, no service contract can be extended past the End of Support date, and the last day to order an extension is the Last Service Extension Date, 12 months earlier.

How does support work? Vendor technical support is provided by Fortinet through FortiCare. nFlo, a Fortinet Advocate Partner, offers local deployment and support.