10-port desktop NGFW delivering 10 Gbps IPv4 firewall for small offices and branches of 10–30 users.
The FortiGate 60F is positioned for small offices and branches of 10–30 users, with 10 GE RJ45 ports, 10 Gbps IPv4 Firewall throughput and 700 Mbps Threat Protection capacity. It runs on the SoC4 ASIC and offers 630 Mbps SSL Inspection, 6.5 Gbps IPsec VPN, built-in SD-WAN and ZTNA. The FG-61F variant stores logs locally on a 128 GB SSD.
FortiGate 60F is FortiGate's F-series desktop model for the small office and branch segment. According to the official data sheet it delivers 10 / 10 / 6 Gbps IPv4 Firewall throughput with 1518/512/64 byte UDP packets, 1.4 Gbps IPS, 1 Gbps NGFW and 700 Mbps Threat Protection throughput; it carries 10 GE RJ45 ports in total and runs at 0 dBA in a fanless desktop form factor (FortiGate 60F Series Data Sheet, 2026).
What distinguishes the FortiGate 60F is not so much raw speed as its port density and access-layer capacity. According to the data sheet the unit has 2 GE RJ45 WAN ports, 1 DMZ port, 5 internal ports and 2 FortiLink ports — 10 Gigabit Ethernet ports in total. The same page specifies management of up to 64 FortiAP units (32 of them in tunnel mode) and 24 FortiSwitch units; this means a single device can bring the entire wired and wireless access layer of a small office under one policy engine. The limits of 700,000 concurrent TCP sessions, 35,000 new sessions per second and 2,000 firewall policies are the right range for a head office or a mid-sized branch of 10–30 users.
In Turkey the 60F is commonly positioned in bank and finance branches, retail stores, accountancy and law firms, and small business head offices. The shared problem of these organizations is producing the audit trail of a network that processes personal data from a single desktop device: the 60F forwards traffic and threat records to FortiAnalyzer or FortiAnalyzer Cloud, meeting the access-record and retention obligations under KVKK (Turkey's data protection law), while in branches handling card data the segment separation expected by PCI-DSS is built with 10 VDOMs and a VLAN structure. Because the FG-61F variant carries a 128 GB internal SSD, it also provides a limited amount of local log and reporting space.
SoC4 ASIC and hardware acceleration: the 60F runs on SoC4, the system-on-a-chip architecture Fortinet developed for desktop models. Firewall and IPsec VPN traffic is processed on this dedicated hardware rather than the CPU; the CPU is reserved for management operations and for exception traffic that cannot be accelerated. You can see the result in the data sheet figures: the 9 Mpps packet processing rate and 3.3 µs firewall latency that a general-purpose x86 platform of the same size would struggle to reach are a direct output of this ASIC approach. By contrast, inspecting encrypted traffic (SSL Inspection, 630 Mbps) is the most expensive operation here, as it is on every FortiGate, and it is the decisive metric when choosing a model.
The 60F is one of the desktop FortiGates carrying two separate ethernet WAN ports, and it requires no additional licence for SD-WAN. Active-active load balancing or a primary/backup design can be built across those two lines; the application recognition engine steers SaaS traffic (Office 365, Teams, Zoom and the like) onto whichever connection is healthiest at that moment, based on link quality measurements. This design makes it possible to reduce expensive private-line capacity and put several economical internet lines in its place. At branches with poor link quality, the remediation mechanisms in FortiOS (forward error correction and packet duplication) can be brought into play; how much they gain depends on the line's actual loss profile, so we recommend taking measurements before enabling them.
Remote access with ZTNA: the 60F's built-in ZTNA Application Gateway replaces the classic remote access VPN. In the traditional approach the user is admitted to the network once authenticated; with ZTNA, user identity, device posture and target application are evaluated together in every session, and the user sees only the application they are authorized for. This least-privilege model maps directly onto the access-restriction and record-keeping expectations of KVKK (Turkey's data protection law). There is a critical note on the release side: although the data sheet lists 900 Mbps SSL-VPN throughput for the 60F, a footnote on the same page states that SSL-VPN is not supported in FortiOS 7.6.0 and above; for that reason new deployments should be planned on IPsec VPN or ZTNA.
These two models are often compared with a crude line such as "the 70G is twice as fast"; the official data sheets do not support such a difference. Large-packet firewall capacity is 10 Gbps on both models. The real difference lies in three places: small-packet performance (6 Gbps versus 10 Gbps at 64 byte UDP), session capacity (700,000 versus 1.4 million) and inspected traffic (SSL Inspection 630 Mbps versus 1.4 Gbps). The table below sets out the verified figures for the three entry-level models side by side:
| Metric (official data sheet) | FortiGate 40F | FortiGate 60F | FortiGate 70G |
|---|---|---|---|
| IPv4 Firewall Throughput (1518 byte UDP) | 5 Gbps | 10 Gbps | 10 Gbps |
| IPv4 Firewall Throughput (64 byte UDP) | 5 Gbps | 6 Gbps | 10 Gbps |
| Firewall Throughput (packets per second) | 7.5 Mpps | 9 Mpps | 15 Mpps |
| IPS Throughput | 1 Gbps | 1.4 Gbps | 2.5 Gbps |
| NGFW Throughput | 800 Mbps | 1 Gbps | 1.5 Gbps |
| Threat Protection Throughput | 600 Mbps | 700 Mbps | 1.3 Gbps |
| SSL Inspection Throughput | 310 Mbps | 630 Mbps | 1.4 Gbps |
| IPsec VPN Throughput (512 byte) | 4.4 Gbps | 6.5 Gbps | 7.1 Gbps |
| Concurrent sessions (TCP) | 700,000 | 700,000 | 1.4 million |
| New sessions per second (TCP) | 35,000 | 35,000 | 100,000 |
| Max. FortiAP (total / tunnel) | 16 / 8 | 64 / 32 | 96 / 48 |
| Power consumption (average) | 7.74 W | 10.17 W | 12.3 W |
The decision rule becomes simple: if you are going to inspect encrypted traffic end to end, or if you have a profile with a high session establishment rate, the FortiGate 70G is the right choice. If it is a single site of just 5–10 users, you can start with the FortiGate 40F. For the full model list and the positioning logic, see our FortiGate product page, and for the entire Fortinet portfolio our Fortinet solutions page.
For a standard FortiOS major or interim release, Fortinet provides 36 months of engineering support from the date of general availability, followed by 18 months of "Must Fix" support; on Long-Term Supported releases that period extends to a total of 72 months including an 18-month Urgent Fix phase, and LTS access requires a FortiCare Elite contract (Fortinet Product Life Cycle, 2026). This calendar is announced per release and is revised by Fortinet from time to time; rather than quoting a fixed end date here, we therefore check the current record for the relevant release together with you before purchase on every 60F project. Two concrete constraints determine the release decision on the 60F. The first is SSL-VPN: although the data sheet lists 900 Mbps SSL-VPN throughput, footnote 6 on the same page says the feature is not supported in FortiOS 7.6.0 and above; organizations still running remote access over SSL-VPN need to draw up a migration plan to IPsec or ZTNA before upgrading. The second is on the subscription side: footnote 1 to the services table on the same data sheet states that the Content Disarm and Reconstruct, Video Filtering and Inline CASB services are not available on the 40F/60F series in FortiOS 7.4.4 and later. The 70G does not appear in that footnote; if those three services are part of your compliance requirement, the conversation should be about a hardware change rather than a release change. At Sora Yazılım we determine the release choice on every 60F deployment together with you, based on the support calendar, the active feature set and the organization's upgrade window.
As a Fortinet authorized channel partner we are at your side on the right model variant for the FortiGate 60F, the FortiGuard subscription package, the migration plan from your existing device, and deployment. You can reach us through our contact page for a configuration and quotation matched to your needs.
Internet egress, the site-to-site IPsec VPN to the cloud environment and ZTNA-based remote access are all consolidated on a single FortiGate 60F. With a FortiSwitch added to the FortiLink ports, the wired access layer is brought under the same policy engine as well.
An IPsec tunnel is established between the 60F in the branch and the higher-tier FortiGate at headquarters. The segment handling card data is kept on a separate VLAN and VDOM; all traffic logs are forwarded to FortiAnalyzer to create the PCI-DSS and KVKK (Turkey's data protection law) audit records.
At each store, two economical internet lines are combined on the 60F's dual WAN ports; application-aware steering moves till and stock applications onto the most stable line. New stores are opened with FortiZTP without an engineer travelling to site.
In a practice handling sensitive client data, the 60F divides staff and guest networks into separate VLANs, with web filtering and antivirus profiles kept enabled. In firms that need local logging, the FG-61F variant with its 128 GB SSD is the preferred choice.
The 60F's 64 FortiAP capacity allows a wireless infrastructure spanning several floors to be managed from a single device. Student, teacher and guest SSIDs are kept on separate segments, and web filtering blocks inappropriate content.
Small offices and head offices of 10–30 users, bank and finance branches, retail stores, accountancy and law firms, small clinics, private schools and nurseries, and the SD-WAN endpoints of multi-branch chains.
Fanless desktop NGFW delivering 5 Gbps IPv4 firewall for micro offices of 5–10 users.
DetailsThe SP5 ASIC-based branch NGFW that replaces the 60F: 10 Gbps symmetric firewall, 1.4 million sessions, PoE and FortiWiFi variants.
DetailsDesktop branch firewall with eight PoE/+ ports and a 96 W budget that also powers the access layer.
DetailsBranch model in a desktop form factor offering 28 Gbps firewall and 25 Gbps IPsec VPN, with 10GE uplink capability.
DetailsSora Yazılım handles sizing, licensing, deployment and ongoing management — all from a single team.