FortiGate-VM

FortiGate-VM is the edition of FortiOS that runs as a virtual machine or cloud instance. Fortinet does not publish throughput figures for this product: performance depends on the underlying host hardware and the number of vCPUs you assign to the instance (FortiGate Virtual Appliances Data Sheet, 2025). The right question is therefore not "how many Gbps" but "which license tier, how many vCPUs and which platform".

What size of organization and which platforms is FortiGate-VM suited for?

If your security boundary forms inside a cloud subscription rather than at the entrance to a data center, FortiGate-VM is the right tool: organizations that put AWS VPC or Azure VNet traffic through central inspection, IT teams building east-west segmentation on VMware or Nutanix, multi-region architectures opening a new region without buying hardware, and short-lived dev/test environments. The data sheet lists the AWS (including GovCloud and AWS China), VMware Cloud on AWS, Azure and AzureStack, Google GCP, Oracle OCI, Alibaba Cloud and IBM Cloud marketplaces; in private cloud it lists support for VMware ESXi 6.7/7.0/8.0, NSX-T 3.2/4.0, Hyper-V, KVM/QEMU, XenServer, Nutanix AHV 7.3 (FortiOS 7.6.3+) and Red Hat OpenShift Virtualization 4.17.13 (FortiGate-VM 7.6.0+). The policy model is identical to that of physical FortiGate firewalls.

How do you choose a FortiGate-VM S-series license tier?

Current licensing is the S-series; the old VM00/VM02 naming no longer appears in the data sheet. vCPU count is not the only thing the tier determines — the policy ceiling, the number of VDOMs and the number of manageable FortiSwitch, FortiAP and endpoint devices all depend on the license as well.

Storage is 32 GB – 2 TB at every tier and there is no RAM restriction tied to vCPU count. The sharpest threshold sits between VM-04S and VM-08S: the policy ceiling rises from 10,000 to 200,000, VDOMs from 50 to 500 and FortiSwitch units from 64 to 300. In a multi-tenant design, the choice is VM-08S or above regardless of your raw vCPU requirement. Note also that multi-VDOM requires a separate subscription license, and the number of network interfaces you can define on one instance is 24 as of FortiOS 6.4.0 (18 before that).

How is performance sized and which FortiOS version should you use?

On hardware FortiGates, FortiASIC takes over the IPS, SSL inspection and IPsec load; a single NP7 carries up to 200 Gbps and as many as 12 million sessions across two 100 GbE interfaces (Fortinet Document Library, 2026). Virtual instances have no such ASICs; inspection runs on the host CPU. In return, the data sheet defines two software acceleration paths for FortiGate-VM: vSPU, which moves part of packet processing into user space and applies kernel bypass within the operating system — according to the data sheet it raises throughput on a UDP firewall rule to more than three times — and support for Intel QuickAssist (QAT), which accelerates site-to-site IPsec traffic; with QAT a two- to three-fold improvement is reported depending on packet size (FortiGate Virtual Appliances Data Sheet, 2025). FortiGate-VM sizing is therefore based not on link capacity but on the security profiles you intend to enable; the decisive line item is SSL inspection, because more than 95% of global web traffic is encrypted (CyberRatings.org, 2025).

The S-series is supported on FortiOS 6.4.0 and later as well as the 7.x releases; the support calendar drives the version choice. With bulletin CSB-260330-1 dated March 2026, end of support for FortiOS 7.4 was extended to November 11, 2028 and for FortiOS 7.6 to January 25, 2030 (Fortinet Community, 2026). On LTS releases total support extends to 72 months and requires a FortiCare Elite contract; FortiOS 8.0, meanwhile, was announced on March 10, 2026.

FortiGate-VM, FortiGate CNF or hardware FortiGate?

The decision rule is simple: if you want the full FortiOS feature set and VDOM separation, choose FortiGate-VM; if you would rather not operate the firewall software layer at all on AWS or Azure, choose FortiGate CNF; and if you need committed throughput and ASIC acceleration, choose hardware — the FortiGate 200F at campus scale, the FortiGate 400F at the data center edge.

As a Fortinet authorized channel partner, Sora Yazılım provides tier assessment, license procurement, deployment on AWS/Azure/GCP/OCI and in VMware, Hyper-V and Nutanix environments, migration of existing hardware policies to the virtual instance, and managed services for FortiGate-VM. For workloads in scope of KVKK (Turkey's data protection law) we plan region selection and log retention together with you. Reach us through our contact page for a quote.