7 Factors That Determine FortiGate Pricing: Model, Bundle and Term

FortiGate pricing is not a single list figure but the sum of seven variables: the hardware model, the FortiGuard license bundle (ATP, UTP, Enterprise), the contract term (1, 3 or 5 years), the FortiCare support level, the renew-or-replace decision, exchange rate and procurement timing, and the scope of installation and managed services. This article explains how and why each factor moves the price; it quotes no amounts, but shows what you must clarify before requesting a quote.

Why is FortiGate pricing not a single list figure?

FortiGate pricing cannot be a single product tag because what you buy is not a box but a package of three separate contracts: the hardware, the FortiCare technical support and hardware replacement contract, and the FortiGuard security services subscription. The same model reaches very different totals depending on the bundle and term combination.

In Fortinet's ordering structure a FortiGate is purchased in one of two ways: hardware only (with FortiCare and FortiGuard added separately) or as a "Hardware plus" SKU that combines the appliance with FortiCare Premium and the chosen FortiGuard bundle for 1, 3 or 5 years. The second route is simpler to order and budget; the first offers flexibility when different terms or bundles are needed. Which one you pick changes the total on the quote.

That is why, in our projects, we ask customers to settle four questions before "how many users": the internet link bandwidth plus three years of growth, whether encrypted traffic will be inspected, which security services will actually be used, and how many budget years are planned. The seven factors below translate those answers into price lines. Our firewall selection guide for SMBs covers model choice in a broader frame and complements this article.

Factor 1: Model and hardware class — which office needs which appliance?

The FortiGate model is the most visible component of the price, and the right model is chosen by inspected traffic capacity, not by user count. Two desktop appliances that look alike can differ several-fold in SSL Inspection and Threat Protection throughput; that gap shows up in both the hardware price and the license price tied to that hardware.

Because FortiGuard subscriptions are priced per model, the model decision sets not only the cost of the box but the license cost of every renewal period that follows. "Let's go one size up" therefore costs far more over five years than the hardware delta suggests; the opposite, buying small and being forced to switch SSL inspection off, neutralises the security investment. The values below come from Fortinet's official data sheets and are maximum figures.

What the table means for price: the 60F and 70G share the same port count and the same large-packet firewall capacity, yet the 70G inspects encrypted traffic more than twice as fast. In a branch that will inspect encrypted traffic, the 60F's lower hardware price returns as an early replacement or a second appliance once capacity runs out. See the detailed office-by-office comparison in our FortiGate 40F, 60F, 70G and 90G comparison, and the positioning of every hardware and virtual model on our FortiGate product page.

A software limit tied to the model also affects the pricing decision: according to Fortinet's FortiOS 7.6 release notes, SSL VPN web and tunnel mode were removed as of FortiOS 7.6.0 from models with 2 GB of RAM or less, a group that includes entry-level desktop models such as the 40F and 60F (Fortinet FortiOS 7.6.0 release notes); the 7.6.1 notes add the 90G and 91G to that scope. In FortiOS 7.6.3, tunnel mode was replaced with IPsec VPN on all models, and web mode was renamed "Agentless VPN" and is not available on the 40F, 60F or 90G; existing SSL VPN settings are not carried over to the new release. If your remote-access plan relies on SSL VPN, the move to IPsec or ZTNA must be costed at quote stage; verify your model's current status against Fortinet's release notes.

Factor 2: FortiGuard license bundle (ATP, UTP, Enterprise)

The FortiGuard license bundle is the largest price line after hardware and comes in three tiers: Advanced Threat Protection (ATP), Unified Threat Protection (UTP) and Enterprise Protection. Each tier adds services on top of the previous one, and the price rises with the tier. The right bundle is chosen by which services will actually be used.

According to Fortinet's FortiGuard security bundles page, the ATP bundle includes IPS, anti-malware (antivirus and cloud-based sandbox), application control and FortiCare Premium support. The UTP bundle adds DNS filtering, URL/web filtering, video filtering and anti-botnet/C2 communication blocking. Enterprise Protection layers data loss prevention (DLP), attack surface monitoring and risk scoring, AI-based inline malware prevention, and IoT device detection with vulnerability correlation on top of UTP (Fortinet FortiGuard Security Bundles).

In our field experience most SMB projects start with UTP, because web and DNS filtering are the most tangible services for cutting user-driven risk. ATP makes sense where web filtering already happens at the endpoint or in a cloud layer. Enterprise Protection comes up with finance, healthcare and manufacturing customers that want DLP, IoT/OT visibility or audit reporting. If you want to decide by seeing what each service does, read our guide to the FortiGuard UTP, ATP and Enterprise bundle differences.

The critical pricing point: bundle prices are set per model. The same UTP bundle is priced one way for a 40F and another way for a 90G. "Which bundle" therefore cannot be answered independently of "which model"; the two are optimised together. Fortinet also offers points-based, usage-billed licensing through its FortiFlex programme, which gives flexibility especially for virtual FortiGates and variable workloads (Fortinet FortiFlex).

Factor 3: Contract term — why are 1, 3 and 5 years priced differently?

The contract term means FortiGate license and support contracts can be bought for 1, 3 or 5-year periods. Multi-year contracts are generally priced at a lower unit cost per year and lock the price for the whole period; in return, the upfront cash outlay is higher and the term must match the planned life of the appliance.

Two questions decide the term. The first is cash flow: a three-year contract needs three years of budget approved at once. The second is hardware life: a five-year contract assumes the appliance will still have enough capacity in year five. In an organisation whose traffic grows fast, a five-year contract on an appliance that becomes too small in year three means unused license time. We therefore usually evaluate three years for entry-level models and five years for mid-range appliances bought with generous headroom; the final call is made by comparing unit costs on the quote.

A frequently overlooked detail is co-termination: organisations with several appliances align all contracts to end on the same date, reducing renewal management to a single calendar. That does not lower the price directly, but it removes the risk of services stopping because a renewal was forgotten. The checklist in our article on FortiGate license renewal costs and budgeting makes renewal planning easier.

Factor 4: FortiCare support level (Essentials, Premium, Elite)

The FortiCare support level sets the technical support and hardware replacement (RMA) line of FortiGate pricing. According to Fortinet's FortiCare ordering guide, Premium offers 24x7 access and a one-hour response target for critical issues; Elite adds a 15-minute response target for critical issues, a higher SLA, extended engineering support and a monitoring portal. All FortiGuard bundles already include Premium.

The price effect appears at two points. First, organisations that buy hardware and FortiCare without a FortiGuard bundle (for example, appliances used purely as firewall/VPN) select the support level separately and pay for it separately. Second, the upgrade from Premium to Elite is a separate SKU priced per model; it is considered for critical production lines and for healthcare and finance customers operating 24x7 (Fortinet FortiCare Ordering Guide).

An easily missed aspect of Elite concerns the FortiOS lifecycle: access to Long-Term Supported (LTS) releases requires a FortiCare Elite contract. For appliances planned for five-year depreciation this is a release-planning question as much as a support-speed question. We explain the SLA differences between the tiers and which organisation needs which in our FortiCare Premium versus Elite comparison. Fortinet's ordering guide also lists a more basic Essentials option for entry-level desktop models; verify the eligible models in the current guide.

Factor 5: Renew or replace? How does the age of the current appliance affect price?

The renew-or-replace decision is the strategic factor that changes FortiGate pricing the most: the license renewal cost of an old model can approach the combined hardware and bundle cost of a new model in the same segment. If the appliance is nearing end of support on Fortinet's lifecycle calendar, renewal becomes an expense that will soon be repeated.

We look at three data points. First, lifecycle status: Fortinet publishes end-of-sale and end-of-support dates for every model, and buying a three-year license for an appliance approaching end of support makes no sense. Second, capacity: if the appliance already hits its CPU limit with SSL inspection on, renewal only postpones the problem. Third, FortiOS version compatibility: new features (for example, current ZTNA capabilities) require a new release, and a new release may not be supported on old hardware.

Combining the three yields two typical outcomes. Where capacity is adequate, the lifecycle is open and release support continues, renewal is by far the more economical choice. Otherwise a new model bought as a "Hardware plus" bundle puts hardware and licenses into a single contract and lowers total cost of ownership. We walk through the decision tree step by step in FortiGate license renewal or a new appliance?

Factor 6: Exchange rate, supply chain and quote timing

Exchange rate and procurement timing are the external factors that can change FortiGate pricing in Türkiye from week to week for the very same configuration. Fortinet products are sourced through distributors at foreign-currency list prices; a Turkish lira quote depends on the exchange rate on the invoice date and on that day's stock position. Quote validity therefore matters.

In practice we give three recommendations. First, request the quote in foreign currency together with its lira equivalent, so you can see which lines are exposed to the exchange rate. Second, get the delivery time of any out-of-stock model in writing with the quote; a supply delay shifts the other project lines (cabling, switches, installation schedule). Third, do not rush the term and bundle decision in a purchase squeezed into the end of the budget year; the wrong bundle in a three-year contract costs far more than a one-off currency advantage.

Contract structure also plays a role in timing. Buying hardware only and adding the license later looks cheaper at the start, but if activation slips the appliance runs without FortiGuard signatures. We align the license start with the commissioning date so that subscription and support are active the day the appliance leaves the box. As an independent solution partner for Fortinet, Sora Yazılım handles project, procurement, installation and managed service end to end; we work from need-based quotes rather than price lists.

Factor 7: Installation, migration and managed-service scope

Service scope is the least visible yet most variable line of a FortiGate quote: initial configuration, policy migration from the old firewall, VPN and SD-WAN design, logging infrastructure, and the monitoring and maintenance that follow. The same hardware and license produce very different totals between "drop off the box" and a managed firewall service.

To make the scope explicit, we ask for the following items to be listed separately in quotes:

• Initial configuration: interfaces, VLANs, security profiles, SSL inspection certificate distribution and logging.
• Migration: analysis of the existing rule base, removal of unused rules, conversion with FortiConverter and lab validation.
• Remote access: IPsec or ZTNA design, FortiClient rollout, identity integration.
• Cutover: maintenance window, rollback plan, acceptance tests.
• Managed service: monthly rule audit, firmware updates, event monitoring, reporting and on-call coverage.

A managed service lowers total cost especially for SMBs without an in-house firewall specialist, because the outage and exposure created by a misconfigured appliance cost more than the service fee. We describe what the service covers and who needs it in what is a managed firewall service? The most common mistake we see when comparing quotes is weighing a price without a service line against one that includes it.

Frequently Asked Questions

What determines FortiGate pricing?

FortiGate pricing is determined by the hardware model, the FortiGuard license bundle (ATP, UTP, Enterprise), the contract term (1, 3, 5 years), the FortiCare support level, the renew-or-replace decision, exchange rate and stock position, and the installation/managed-service scope. That is why a project-specific quote replaces a list price.

Does a FortiGate work without a license?

It works, but in a limited way. When the FortiGuard subscription expires the appliance keeps performing firewall, NAT and VPN duties; IPS, antivirus, web filtering and application control signatures stop updating. That reduces the appliance from an enterprise firewall to a basic router, which is why the renewal calendar must be tracked.

Is the price difference between UTP and Enterprise Protection worth it?

It is worth it if you will actually use Enterprise-only services such as DLP, attack surface monitoring, IoT detection or AI-based inline prevention. For an SMB that will not use those services, UTP is usually the right balance. Decide by the list of services you will use, not by the bundle list.

Is a 3-year license always more economical?

In unit cost per year, generally yes, provided the appliance remains adequate in capacity and lifecycle for the full three years. Buying a long contract for an appliance approaching end of support or running out of capacity means paying for license time you will not use.

Is FortiCare Premium enough, or do I need Elite?

For most SMBs the Premium level that comes with FortiGuard bundles is enough. Elite makes sense for organisations that want a 15-minute critical response target, a higher SLA and access to Long-Term Supported FortiOS releases, where downtime translates directly into lost revenue. The upgrade is priced separately per model.

Why does FortiGate pricing in Türkiye change with the exchange rate?

Because Fortinet products are sourced through distributors at foreign-currency list prices, a Turkish lira quote depends on the exchange rate on the invoice date. Ask for the quote in foreign currency with its lira equivalent, and get the validity period and stock status in writing.

What information does Sora Yazılım need for a FortiGate quote?

Internet link bandwidth and growth expectation, number of users and sites, whether encrypted traffic will be inspected, remote-access needs, the existing firewall and its rule count, the desired contract term, and the installation/managed-service expectation. With these we prepare a sizing report and a written quote.

Conclusion

Reducing FortiGate pricing to a single figure prepares the ground for the most expensive mistake: entering a three-year contract with the wrong model or the wrong bundle. Clarifying the seven factors in order (model, license bundle, term, support level, renew-or-replace, exchange rate and procurement timing, service scope) makes quotes comparable and keeps total cost of ownership under control.

We can work out the model, bundle and term combination for your traffic profile and budget cycle together. Request a free discovery call for a sizing report and written quote through our contact page.