FortiGate Licensing and FortiGuard Subscriptions Guide
FortiGate licensing consists of the hardware/virtual device itself plus FortiGuard security subscriptions and support services. The device can do basic firewalling unlicensed; but up-to-date protections such as antivirus, IPS, and web filtering require a FortiGuard subscription.
The FortiGate Licensing Model
The FortiGate licensing model rests on two components: the hardware bought once (or a time-based virtual license) and the time-based FortiGuard security subscriptions plus FortiCare support that keep the device current.
When you buy a hardware FortiGate, the device is yours; but because security content (signatures, categories) must be continuously updated, FortiGuard subscriptions are renewed on a time basis. For FortiGate-VM, the licensing model varies by vCPU count and subscription term.
FortiCare support covers operational needs such as hardware replacement (RMA), technical support, and firmware access. Security subscriptions and support are usually offered under the same bundle.
Device selection and license planning should be considered together; for model selection, see the model-selection section of our what is FortiGate guide.
Subscription Bundle Types
Subscription bundles group the security services you need; they typically range from basic bundles to comprehensive ones (e.g., UTP and Enterprise Protection).
Broader bundles collect more FortiGuard services under a single license. Which bundle fits depends on the security profiles you will use.
| Bundle approach | Typical coverage |
|---|---|
| Basic/IPS-focused | IPS and limited services |
| UTP (Unified Threat Protection) | Antivirus, IPS, web/DNS filtering, app control, support |
| Enterprise/ATP | Additional services on top of UTP and advanced threat protection |
We detail how the profiles within a bundle work in our UTM security profiles guide.
FortiGuard Security Services
FortiGuard services are FortiGate's threat-intelligence source; they continuously update antivirus and IPS signatures, web and DNS filtering categories, application signatures, and botnet reputation data.
Without these services the security profiles age over time; new malware and attack signatures never reach the device. FortiGuard is fed by a global threat-research infrastructure and distributes updates automatically.
- Antivirus signature updates.
- IPS/attack signature updates.
- Web and DNS filtering category database.
- Application control signatures.
- Botnet/command-and-control reputation data.
Subscription Renewal and Expiry
Subscription renewal is critical for continuity of protection; when it expires, FortiGuard updates stop and the device becomes increasingly vulnerable to new threats.
When a subscription expires, basic protection may keep running for a while on existing signatures, but no new signature or category updates are received. Some services are fully disabled after expiry.
To avoid gaps, renew subscriptions before they expire and, if you have many devices, track renewal dates centrally. FortiManager or inventory tracking removes expiry surprises.
Choosing the Right License
The right license is chosen by considering the security profiles you will use, compliance requirements, and budget. An overly broad bundle raises cost, while a narrow one creates protection gaps.
First determine which UTM profiles you will actually use (IPS only, or antivirus + web filtering + app control?). Choose the bundle to match that need and factor in your growth plan.
If you want to compare licensing models with alternative platforms, see our FortiGate vs Palo Alto, Sophos, and Check Point comparison.
Frequently Asked Questions
Does FortiGate work without a license?
The device can do basic firewalling, NAT, and VPN without a FortiGuard subscription. But up-to-date protections such as antivirus, IPS, and web filtering require a FortiGuard subscription.
What does the UTP bundle cover?
UTP (Unified Threat Protection) typically bundles core FortiGuard services such as antivirus, IPS, web and DNS filtering, and application control along with support. Exact coverage may vary by current product listing.
What happens if the subscription expires?
FortiGuard updates stop; basic protection may persist for a while on existing signatures, but protection against new threats weakens over time. Some services may be fully disabled.
What is the difference between FortiCare and FortiGuard?
FortiCare covers operational services such as hardware replacement and technical support; FortiGuard provides security content (signature and category) updates. The two are usually sold under the same bundle.
How does FortiGate-VM licensing work?
FortiGate-VM is licensed by vCPU count and subscription term; BYOL or, in cloud marketplaces, PAYG can be used. Security subscriptions are added similarly to the hardware model.
Which bundle should I choose?
Choose by the security profiles you will use. If IPS only suffices, a narrower bundle works; if you need comprehensive UTM, UTP or Enterprise bundles fit. Factor in your growth plan too.
Conclusion
FortiGate licensing integrates with FortiGuard subscriptions that unlock the device's real security value. The right bundle and timely renewal optimize cost without protection gaps.
To review your license inventory and identify the right bundle, talk to the Sora Yazılım team.