Which FortiGate do I need for a 20-person office?
Start from the internet circuit, not the headcount. A FortiGate 50G handles about 1.1 Gbps of threat-protection throughput and a 70G about 1.3 Gbps, so a 50G covers a circuit up to about 750 Mbps for 20 people and a 70G covers up to 1 Gbps. The 70G adds ten gigabit ports and a PoE variant; the 50G has five. If the circuit is no faster than about 750 Mbps, one managed switch handles the LAN and you need no PoE from the firewall, the 50G is enough. If the firewall is also the core switch for a small office, take the 70G. Either way, we check session load and the inspection profile you plan to run against the datasheet before we quote.
What is the difference between the FortiGate 70G and 90G?
Inspection capacity and uplinks. The 90G rates 4.5 Gbps IPS and 2.2 Gbps threat protection against 2.5 and 1.3 Gbps on the 70G, and it adds two shared-media pairs that take 10G, 5G or 2.5G copper or SFP+ fiber. If your core switch has 10G uplinks or your circuit exceeds 1 Gbps, the 90G is the smallest G-series that keeps up. The 70G is the right model for a gigabit office with gigabit switching.
Is the FortiGate 30G big enough for a small business?
For a site on a 100 to 300 Mbps circuit with a handful of users, yes. Its threat-protection throughput is 500 Mbps, and it has four gigabit ports. It is not the right choice if the circuit is 500 Mbps or faster, or if you plan to run SSL inspection on most traffic; deep SSL inspection on the 30G is rated at 400 Mbps.
Should I buy a 60F or a 70G?
Buy the 70G unless you depend on SSL-VPN and cannot move off it yet. The 60F is a 2 GB RAM model and loses SSL-VPN on upgrade to FortiOS 7.6, and it reaches end of order on January 13, 2027 (end of support January 13, 2032); the 70G is current-generation SP5 hardware with IPsec or ZTNA remote access from day one.
How many users can a FortiGate 50G support?
Fortinet’s SMB sizing guide puts the 50G at 10 to 25 users, but the circuit decides it, not the headcount. We keep the internet speed at or below about 70 to 80 percent of its 1.1 Gbps threat-protection throughput, which is a circuit up to about 750 Mbps. User counts depend on traffic: heavy SSL inspection, video and file sync load a firewall more than the same number of people on email, so we also check concurrent sessions (720,000) and new sessions per second (85,000) against your traffic.
Does the FortiGate 50G have Wi-Fi?
The FortiGate 50G has no radio. The Wi-Fi version is the FortiWiFi 50G: Fortinet’s datasheet lists a dual-radio 2.4 GHz / 5 GHz, 802.11ax (Wi-Fi 6) interface with 2x2 MU-MIMO and the same 1.1 Gbps threat-protection rating. There are FortiWiFi versions of the 51G, 50G-SFP, 50G-DSL and 50G-5G as well. Our model pages list FortiGate part numbers; we quote FortiWiFi models by part number on request.
Are the FortiGate 30G, 50G, 70G and 90G fanless?
The 50G and 70G are. Their datasheets list the FortiGate models as fanless, the 50G at 0 dBA. The 90G datasheet lists a 21.73 dBA noise level instead. The 30G datasheet gives no noise figure, so we do not claim either way. Among the Wi-Fi models, the FortiWiFi 50G-5G-II and FortiWiFi 70G-POE list noise levels of 21.73 and 17.75 dBA.
FortiGate 50G vs 60F: which should I buy?
The 50G has the higher inspection figures: 1.1 Gbps threat protection, 2.25 Gbps IPS and 1.3 Gbps SSL inspection, against 700 Mbps, 1.4 Gbps and 630 Mbps on the 60F. The 60F has more ports: ten gigabit ports (two WAN, one DMZ, five internal, two FortiLink) against five on the 50G. Both are fanless. The 60F is a 2 GB RAM model that lost proxy features in FortiOS 7.4.4 and SSL-VPN in 7.6; the 50G has no SSL-VPN at all (its datasheet lists none), so remote access is IPsec or ZTNA. If you need the 60F’s port count, the current-generation equivalent is the 70G. The 60F reaches end of order on January 13, 2027.
FortiGate 40F vs 50G: what changed?
The port layout is the same: five gigabit ports, one WAN, three LAN and one FortiLink, and both are fanless. The 50G is ahead on every inspection figure: 1.1 Gbps threat protection against 600 Mbps, 2.25 Gbps IPS against 1 Gbps, and 1.3 Gbps SSL inspection against 310 Mbps. The 40F is a 2 GB RAM model, so it lost proxy features in FortiOS 7.4.4 and SSL-VPN in 7.6. Fortinet’s datasheets also list Content Disarm and Reconstruct, DNS and video filtering and inline CASB as unavailable on the 40F from 7.4.4 and on the 50G in any FortiOS build.
Do these throughput numbers apply to my traffic?
They are Fortinet’s datasheet figures, tested as described in each datasheet. Real throughput depends on which profiles you enable, how much traffic you SSL-inspect, and session rate. We apply rule 1 above, then check sessions per second and concurrent sessions against the datasheet.
Which models support HA?
All four support FortiGate high availability in active-passive mode with identical units. Each member needs its own FortiCare and FortiGuard subscription. For small offices we pair a 70G or 90G; a 30G or 50G HA pair rarely makes sense because the budget is better spent on a single larger unit with a four-hour hardware replacement contract, where Fortinet offers one for your model and location.
Which licensing bundle should I buy?
Start with the Unified Threat Protection bundle described above. Enterprise Protection adds further FortiGuard services; it is not the default. On 30G/50G, Fortinet’s datasheets note that Content Disarm and Reconstruct, DNS/video filtering and inline CASB are not available on the hardware under any bundle, so we confirm feature fit before quoting. Terms run one, three or five years, and we quote the exact Fortinet part number so the term and the contents are unambiguous.
Can you size and install it?
Yes. Send the circuit speed, user count, switching and PoE needs, and what the firewall must do. We recommend a model, quote hardware and licensing by exact part number through our distributor, and run the work at a fixed price: $2,500 for a like-for-like swap of one FortiGate up to the 90-series class that keeps the same design, with hardware and licensing quoted separately. A firewall migration (a design change or another vendor) starts at $6,500 for a single firewall up to the 90-series class, or $8,900 for 100F–200F or an HA pair, with the fixed fee set by the assessment. A Network Risk Assessment ($3,500 for a single small site) maps what is on the network first; a sample report (PDF) shows what it covers.
