2U data center firewall: 198 Gbps IPv4 firewall, 4x 100GE QSFP28 slots and 12 million concurrent sessions with NP7 acceleration.
The FortiGate 1800F is a 2U data center firewall that, according to its official datasheet, delivers 198 Gbps IPv4 Firewall, 22 Gbps IPS and 15 Gbps Threat Protection throughput. With four 100GE QSFP28 slots, 12 million concurrent TCP sessions and SPU NP7 + CP9 acceleration, it targets north-south traffic in medium to large data centers and large campus cores.
The FortiGate 1800F is a 2U data center firewall listed on its official datasheet with 198 / 197 / 140 Gbps IPv4 Firewall throughput (1518 / 512 / 64 byte UDP), 22 Gbps IPS, 17 Gbps NGFW and 15 Gbps Threat Protection throughput. With four 100GE QSFP28 / 40GE QSFP+ slots, 12 million concurrent TCP sessions and SPU NP7 + CP9 hardware acceleration, it is aimed at north-south traffic in medium and large data centers, campus cores and high-density IPsec aggregation roles (FortiGate 1800F Series Data Sheet, 2026). The model sits in the data center group of the FortiGate NGFW family.
When selecting a data center firewall, firewall throughput on its own is misleading. CyberRatings.org has reported that more than 95% of global web traffic is encrypted and that some of the products tested suffered a marked performance drop while inspecting encrypted traffic (CyberRatings.org, 2025). On the FortiGate 1800F datasheet, SSL Inspection Throughput is 12 Gbps, SSL inspection concurrent session capacity is 1.3 million and SSL inspection CPS is 9,500. Your inspected traffic volume must be planned against those lines; 198 Gbps describes uninspected L3/L4 forwarding only.
The FortiGate 1800F suits organizations that run 100 Gigabit class uplinks in the data center, generate more than 10 Gbps of inspected traffic (IPS + antivirus + application control) and whose session table climbs above 8 million. In practice that profile covers regional cloud providers, the primary data center of multi-branch banks, large university and city hospital campuses, the application tier of e-commerce platforms and SD-WAN hubs aggregating thousands of IPsec tunnels. The appliance scales to those loads with 20,000 site-to-site and 100,000 client-to-site IPsec tunnels, 100,000 firewall policies and 10 default / 250 maximum VDOMs.
The lower bound deserves attention: the 1518 byte IPv4 Firewall throughput of the 1800F is 198 Gbps, and that figure is identical to the FortiGate 1000F. The difference between the two models is not in raw forwarding but in inspection capacity (IPS 22 Gbps versus 19 Gbps; Threat Protection 15 Gbps versus 13 Gbps) and in the session table (12 million versus 7.5 million). If all you are chasing is higher Gbps, moving to the 1800F delivers no measurable gain; if your requirement is session density, port count and inspection headroom, it is the right model.
A common misconception is that the 2600F offers many times the firewall throughput of the 1800F. The official datasheets do not support that: both models are rated at 198 Gbps IPv4 Firewall throughput at 1518 bytes, 210 Mpps packet processing and 55 Gbps IPsec VPN throughput. The difference lies entirely in inspection performance, session capacity and multi-tenancy.
| Metric (official datasheet) | FortiGate 1000F | FortiGate 1800F | FortiGate 2600F |
|---|---|---|---|
| IPv4 Firewall Throughput (1518 byte UDP) | 198 Gbps | 198 Gbps | 198 Gbps |
| Firewall Throughput (pps) | 201 Mpps | 210 Mpps | 210 Mpps |
| IPS Throughput | 19 Gbps | 22 Gbps | 31 Gbps |
| NGFW Throughput | 15 Gbps | 17 Gbps | 27 Gbps |
| Threat Protection Throughput | 13 Gbps | 15 Gbps | 25 Gbps |
| SSL Inspection Throughput | 10 Gbps | 12 Gbps | 20 Gbps |
| Concurrent Sessions (TCP) | 7.5 million | 12 million (40 million with Hyperscale) | 24 million (40 million with Hyperscale) |
| New Sessions/Second (TCP) | 650,000 | 750,000 | 1 million |
| Fastest interface | 2x 100GE QSFP28 | 4x 100GE QSFP28 | 4x 100GE QSFP28 |
| VDOMs (default / maximum) | 10 / 250 | 10 / 250 | 10 / 500 |
| Form factor / average power | 2 RU / 210 W | 2 RU / 410.9 W | 2 RU / 416 W |
The rule the table implies is clear: if your inspected traffic exceeds 15 Gbps, your session table exceeds 12 million or your VDOM requirement goes beyond 250, you should move to the FortiGate 2600F. Below those thresholds the 1800F is the more balanced choice in terms of both investment and power and cooling budget; it draws 410.9 W on average and 459.1 W at maximum, and at 62.74 dBA it is noticeably quieter than the 71.72 dBA of the 2600F.
The interface layout consists of 4x 100GE QSFP28 / 40GE QSFP+, 12x 25GE SFP28 / 10GE SFP+ / GE SFP, 8x GE SFP, 16x GE RJ45, 2x 10GE SFP+ / GE SFP HA ports and 2x GE RJ45 management ports. That arrangement makes it possible to connect to the spine layer over 100 GE while terminating access, DMZ and out-of-band segments on the same chassis at 25 GE and 1 GE. The 1800F has no 200GE ports; 200GE QSFP56 and 400GE QSFP-DD support arrives with the FortiGate 3700F. The FG-1801F variant adds two 960 GB NVMe SSDs for local log and archive capacity.
The datasheet hardware note is explicit: 100 GE support requires one of FortiOS 7.0.16+, 7.2.8+, 7.4+ or 7.6+. Release planning must also account for lifecycle. In bulletin CSB-260330-1, published in March 2026, Fortinet extended the end of engineering support for FortiOS 7.4 to May 11, 2027 and its end of support to November 11, 2028; for FortiOS 7.6 the equivalent dates moved to July 25, 2028 and January 25, 2030 (Fortinet Community, 2026). For new 1800F deployments we recommend the 7.6 branch, together with FortiAnalyzer integration for centralized logging and reporting.
The standard session capacity of the 1800F is 12 million concurrent TCP sessions and 750,000 new sessions per second. The values marked with an asterisk on the datasheet require the Hyperscale Firewall license: with it, concurrent sessions rise to 40 million and the new session rate to 2 million per second. The license allows CGNAT functions to run in hardware on the NP7 network processor. According to Fortinet documentation, in this mode the NP7 also takes over session setup, Carrier Grade NAT, hardware logging, HA hardware session synchronization and DoS protection from the CPU; in addition, a single NP7 processor supports up to 12 million sessions and a maximum data rate of 200 Gbps across two 100 Gigabit interfaces (Fortinet Document Library, 2026).
For that reason the Hyperscale license is not a "performance pack" but an architectural decision: it makes sense where there is carrier-style subscriber NAT, NAT44/NAT64 transition driven by IPv4 exhaustion, or IoT and CDN traffic generating millions of short-lived sessions. For classic enterprise north-south inspection the standard license is sufficient. Because the same Hyperscale license family covers the 1800F and 2600F series together, the licensing architecture does not change when you upgrade between the two models. On the inspection side, the CP9 content processor provides more than 10 Gbps of pattern-matching acceleration for flow-based IPS and application control (Fortinet Document Library, 2026).
In Turkey, FortiGate 1800F projects usually arrive alongside personal data processing inventory obligations under KVKK (Turkey's data protection law), BDDK (Turkish banking regulator) information systems audits or PCI-DSS network segmentation requirements; in those scenarios VDOM-based separation and centralized log retention must be part of the design. As a Fortinet authorized channel partner, Sora Yazılım runs capacity validation, HA cluster design, configuration migration from the existing appliance, log retention architecture and managed service processes with you. To confirm whether the 1800F is the right model for your environment's inspected traffic profile and to request a quotation, reach us through our contact page.
For a bank subject to BDDK (Turkish banking regulator) information systems audits, internet and branch traffic is inspected at a single point in the primary data center with IPS, antivirus and application control. The 15 Gbps Threat Protection and 12 Gbps SSL Inspection capacity leaves room to decrypt and examine card and online banking traffic.
250 VDOMs create an isolated policy space per customer; the 4x 100GE QSFP28 slots connect to the spine layer while the 25GE SFP28 ports serve the hypervisor access network. Hardware-accelerated VXLAN segmentation unifies physical and virtual domains under a single policy set.
Clinical systems, medical device VLANs, the guest network and the administrative network are separated on the same chassis. The 16x GE RJ45 and 12x 25GE ports terminate the campus distribution layer directly; the 12 million session capacity absorbs heavy IoT and medical device traffic.
IPsec tunnels from hundreds of stores are aggregated centrally. The 55 Gbps IPsec VPN throughput and 20,000 site-to-site tunnel capacity allow the store network to be terminated on a single hub; new store openings are brought online with a policy template.
Inspection of the internet edge on a higher education campus and compliance with KVKK (Turkey's data protection law) and statutory retention requirements. The 2x 960 GB NVMe SSDs on the FG-1801F provide local buffering while the central archive is held on FortiAnalyzer.
Organizations running medium and large-scale data centers; regional cloud and hosting providers, primary data center teams at banks and financial institutions, city hospital and university campus core administrators, and retail and logistics IT units aggregating hundreds of branches over IPsec.
Fanless desktop NGFW delivering 5 Gbps IPv4 firewall for micro offices of 5–10 users.
Details10-port desktop NGFW delivering 10 Gbps IPv4 firewall for small offices and branches of 10–30 users.
DetailsThe SP5 ASIC-based branch NGFW that replaces the 60F: 10 Gbps symmetric firewall, 1.4 million sessions, PoE and FortiWiFi variants.
DetailsDesktop branch firewall with eight PoE/+ ports and a 96 W budget that also powers the access layer.
DetailsSora Yazılım handles sizing, licensing, deployment and ongoing management — all from a single team.