FortiGate 70G

FortiGate 70G is one of Fortinet's current G-series desktop NGFWs, positioned for branches of 20–50 users and for multi-site chains moving to SD-WAN. According to the official data sheet it delivers 10 Gbps IPv4 Firewall throughput across 1518/512/64 byte UDP packets alike — that is, a symmetric performance profile that does not fall away as packet size shrinks; alongside it come 2.5 Gbps IPS, 1.3 Gbps Threat Protection and 1.4 Gbps SSL Inspection throughput (FortiGate FortiWiFi 70G Series Data Sheet, 2026). Fortinet's current NGFW ordering guide lists the 30G, 50G, 70G, 90G, 120G and 200G under the heading of the latest available models for each series; the 40F and 60F do not appear in that table (Fortinet NGFW/Perimeter Firewalls Ordering Guide, PFW-OG-R28, 2026). That is the basis on which we position the 70G as the refresh path for the 60F.

What size of organization is the FortiGate 70G suited to?

What lifts the 70G into a higher league is not raw bandwidth but its session and packet processing capacity. The device supports 1.4 million concurrent TCP sessions and 100,000 new sessions per second; with a packet processing rate of 15 Mpps it delivers 2.46 µs firewall latency at 64 byte UDP. This profile is decisive for branches that run applications establishing large numbers of short-lived connections (POS terminals, IoT sensors, heavy API traffic, crowded guest networks). The firewall policy limit is 5,000; in branches where segmentation is designed in detail, that headroom gives comfortable room to work. At the access layer, up to 96 FortiAP units (48 of them in tunnel mode) and 24 FortiSwitch units can be managed from a single device.

SP5 Secure SD-WAN ASIC: the 70G family is built on SP5, Fortinet's SD-WAN-focused application-specific integrated circuit. In the data sheet's description, SP5 combines a RISC-based CPU with Fortinet's content and network processors; it accelerates application recognition and steering, IPsec VPN and deep SSL inspection in hardware, and brings access-layer connectivity (FortiSwitch and FortiAP) into the same acceleration domain. Fortinet states that this design delivers higher performance at lower cost and power consumption than conventional CPUs; because the data sheet publishes no numeric multiplier ("30% less power", "3x IPS" and so on), the size of the advantage should be assessed on the measured figures. The measured figure is this: a standard FG-70G consumes only 12.3 W on average while performing 1.4 Gbps of SSL inspection.

On the hardware security side, the 70G series carries two components not found on the 40F and 60F: a Trusted Platform Module (TPM) that generates, stores and validates cryptographic keys, and a physical signed firmware hardware switch that permits only verified FortiOS software to be installed. In store, field office and remote branch deployments where physical access is not fully under control, these two features make a concrete difference. The series also holds an independently verified Environmental Product Declaration (EPD) under ISO 14025 Type III; for organizations that produce sustainability reporting, this is a document that can be added to the procurement file.

How much faster is the FortiGate 70G than the FortiGate 60F in reality?

The claims often repeated in the market — "the 70G is twice the 60F" and "5x SSL performance" — do not match the official data sheets. Large-packet firewall capacity is 10 Gbps on both models; the SSL Inspection difference is from 630 Mbps to 1.4 Gbps, that is roughly 2.2x. The real gain is concentrated in small-packet performance, session capacity and inspected traffic. The table below compares the 70G both with its predecessor, the 60F, and with the 80F in the same segment:

The table reduces model selection to a clear question. If inspected traffic and session establishment rate are your priority, the 70G is markedly ahead of the 80F in the same segment: almost twice as fast on SSL Inspection and more than twice as fast on new sessions per second. If, on the other hand, you need a higher PoE power budget, slightly more concurrent sessions or SFP shared media ports, the FortiGate 80F is the choice. If 10 ports and lower capacity are enough for a small site, the FortiGate 60F is still a valid option. For the positioning of all the models, see our FortiGate product page.

Are there PoE and Wi-Fi options on the FortiGate 70G?

Yes — the series comprises four hardware variants and their wireless counterparts. FG-70G carries 10 GE RJ45 ports in total: 2 WAN ports, 6 internal ports and 2 FortiLink ports. FG-70G-POE keeps the same total port count but reduces the internal port count to 2 and adds 4 GE RJ45 PoE/+ ports; the total usable PoE power budget is 60 W, enough to power IP phones, IP cameras or a FortiAP without needing a separate switch. FG-71G and FG-71G-POE add a 64 GB SSD to the same structure. On the wireless side there is a widespread misconception: the 70G does have an integrated Wi-Fi option. The FortiWiFi 70G (FWF-70G), FWF-70G-POE and FWF-71G SKUs in the ordering list include, in the data sheet's own wording, an "internal dual-band, dual-stream" 802.11ax (Wi-Fi 6) access point. In small single-room branches, wireless coverage can be provided without buying a separate FortiAP; in multi-floor or larger areas, separate FortiAPs are added over FortiLink. Power consumption varies by variant: FG-70G 12.3 W on average, FG-71G 13.4 W, FG-70G-POE 70.3 W, FG-71G-POE 76 W.

Which FortiOS release does the FortiGate 70G support, and does SSL-VPN work?

This is the most important design decision to watch on the 70G: the data sheet lists the SSL-VPN throughput and concurrent SSL-VPN user figures as "N/A" — meaning SSL-VPN is not an option on this model. Remote access must be designed from the outset on IPsec VPN (7.1 Gbps, AES256-SHA256) or the ZTNA Application Gateway. This is consistent with Fortinet's general direction; SSL-VPN was also removed from the 40F and 60F series with FortiOS 7.6.0. On release support, the rule Fortinet publishes is this: on standard releases, 36 months of engineering support is followed by an 18-month "Must Fix" phase, while on LTS releases the total coverage rises to 72 months (Fortinet Product Life Cycle, 2026). Because the end dates of individual releases can be revised, we do not fix dates on this page; on 70G deployments we make the release decision by consulting the official record for the chosen release as it stands on the day. The FortiOS section of the data sheet describes the operating system, in its own words, as a natively AI-powered and quantum-safe platform; for organizations that have put the transition to post-quantum cryptography on their agenda, this is a platform property independent of model choice. We determine the release choice together with you, based on the organization's upgrade window, active feature set and support calendar.

Branch operations and provisioning: the operational reason the 70G becomes a branch standard is that the wired (FG-70G), PoE (FG-70G-POE), SSD (FG-71G) and wireless (FWF-70G) variants of the same family can be managed with a single configuration template: different hardware is shipped according to store type, while the central policy set stays the same. The moment the devices reach the internet on site, they register with central management via their serial numbers and take on their own templates; the only work done on site is cabling. The two ethernet WAN ports can be run active-active or primary/backup under SD-WAN, and application-aware steering shifts till and stock applications onto the other line the instant link quality degrades. On the compliance side, what the 70G really provides is capacity: 5,000 firewall policies and 10 VDOMs are enough to separate the till segment from in-store guest, IoT and staff traffic at the level of detail PCI-DSS expects, while the 1.4 million session table ensures that segmentation does not run out of room under traffic load. On the logging side, forwarding to FortiAnalyzer consolidates the record-keeping obligation under KVKK (Turkey's data protection law) in one central place, regardless of branch count. You can review our entire Fortinet portfolio on our Fortinet solutions page.

The real decision on the 70G is which variant to send: the PoE one, the SSD one, or the one with internal Wi-Fi 6. We make that decision by examining branch type, the devices to be powered and the policy set to be inherited from the 60F together with you; as a Fortinet authorized channel partner we also run the licensing, migration and deployment phases. Write to us through our contact page for a configuration and quotation prepared for your branch inventory.