FortiGate Cloud-Native Firewall (CNF)

FortiGate CNF (Cloud-Native Firewall) is, in Fortinet's own words, a software-as-a-service offering that simplifies cloud network security while delivering availability and scalability; it removes the need to configure, provision and maintain firewall software infrastructure (FortiGate CNF Administration Guide 25.3.a, 2025). The service is in production support on both AWS and Azure — the widely repeated claim that "the AWS side is in beta" is not correct.

Which organizations and which architectures is FortiGate CNF right for?

FortiGate CNF is for organizations that run workloads in the cloud but do not want to operate the firewall itself as an infrastructure component. Instances are hosted on AWS or Azure infrastructure in the same region as the workload they protect; for organizations with data residency and KVKK (Turkey's data protection law) requirements, keeping traffic inside the region is a decisive criterion. The real architectural gain, though, lies in policy scope: a single instance can protect multiple VPCs, availability zones and AWS accounts within a region with one shared policy, and on the Azure side the same construct applies to virtual networks and Azure accounts. In a landing zone with dozens of accounts, this means managing one policy set instead of operating a separate firewall per account. In return, scope is limited to AWS and Azure; if GCP, OCI or a private cloud is in play, FortiGate-VM is what you need.

The timeline also corrects a common misconception: Fortinet made the Cloud-Native Firewall service generally available on AWS first, on November 28, 2022, through AWS Marketplace (Fortinet Newsroom, 2022); Azure support was added later.

What is the difference between FortiGate CNF and FortiGate-VM?

The decision rule is this: if you want to hand off the operational burden and run a single policy across a region, choose FortiGate CNF; if you need full control of FortiOS, VDOM separation, or a platform outside AWS and Azure, choose FortiGate-VM. The two models are not mutually exclusive — in a multi-cloud architecture they are used side by side, and both are part of the same FortiGate product family.

Which security services does FortiGate CNF provide and how is it managed?

The official documentation lists FortiGuard Labs-backed IPS profiles, DNS filtering, geo-IP blocking, known-bad IP address filtering and geo-fencing. In this model, keeping signature and reputation data current is entirely on the service side, and that is exactly where the difference shows: according to FortiGuard Labs' 2026 Global Threat Landscape Report, the time to exploitation on critical advisories has fallen to 24-48 hours and global exploitation attempts rose 25.49% year over year (Fortinet, 2026). The management plane is the CNF portal and the REST API; on the AWS side, Firewall Manager integration handles rolling the deployment out across the organization. The claim that it is "configured only from the Azure portal" does not match current documentation.

How do you plan capacity, and when do you move to hardware?

Fortinet does not publish throughput, concurrent session or new sessions per second figures for FortiGate CNF. The reason is not incomplete documentation but the delivery model: the service scales as SaaS and is not positioned around a fixed capacity limit. In practice, policy planning takes the place of capacity planning. If a regulation or a tender specification demands a measured Gbps figure, hardware is required: the FortiGate 400F delivers 79.5 Gbps of IPv4 firewall and 9 Gbps of Threat Protection throughput, while the FortiGate 1000F delivers 198 Gbps of IPv4 firewall and 13 Gbps of Threat Protection throughput. The choice is not a performance race but a question of where responsibility sits.

As a Fortinet authorized channel partner, Sora Yazılım handles the rollout of FortiGate CNF in your AWS and Azure environments, the migration of existing policies to the shared CNF policy, the design of IPS profiles along with DNS filtering and geo-fencing rules to match your corporate policy, and the managed service. We clarify region selection, log flow and data residency in scope of KVKK (Turkey's data protection law) at the start of the project. Reach us through our contact page for a quote.