FortiGate Sizing Guide
The G-series is Fortinet’s current desktop line, all built on the SP5 processor. The four models differ in inspection capacity, port count, uplink speed, storage options and a few feature limits. The 30G and 50G families do not support some bundle features, including Content Disarm and Reconstruct, DNS/video filtering and inline CASB, even when the bundle description includes them. This guide puts the datasheet numbers side by side and gives the rules we use to pick one. Last reviewed 2026-10-06.
Datasheet Comparison
Figures are Fortinet’s published datasheet values with an enterprise traffic mix. Threat protection means firewall, IPS, application control and malware protection all enabled, which is how a protected office actually runs. That is the number to size against.
| Model | Threat protection | IPS | NGFW | Firewall (1518-byte) | Concurrent sessions | Ports | PoE variant | Storage variant |
|---|---|---|---|---|---|---|---|---|
| FortiGate 30G | 500 Mbps | 800 Mbps | 570 Mbps | 4 Gbps | 600,000 | 4× GE RJ45 (1 WAN, 2 LAN, 1 FortiLink) | No | No |
| FortiGate 50G | 1.1 Gbps | 2.25 Gbps | 1.25 Gbps | 5 Gbps | 720,000 | 5× GE RJ45 (1 WAN, 3 LAN, 1 FortiLink); 50G-SFP adds 1× GE SFP | No | 51G (SSD) |
| FortiGate 70G | 1.3 Gbps | 2.5 Gbps | 1.5 Gbps | see datasheet | see datasheet | 10× GE RJ45 (2 WAN, 2 FortiLink, 6 LAN) | 70G-POE: 4 PoE/PoE+ ports | 71G (SSD) |
| FortiGate 90G | 2.2 Gbps | 4.5 Gbps | 2.5 Gbps | 28 Gbps | 3,000,000 | 8× GE RJ45 + 2 shared-media pairs: 10/5/2.5/1 GE RJ45 or 10GE/GE SFP+/SFP | No | 91G (120 GB SSD) |
Sources: Fortinet FortiGate 30G, 50G, 70G and 90G series datasheets, fetched 2026-10-06. Where the datasheet layout did not expose a figure cleanly it is marked “see datasheet” rather than guessed. Fortinet revises datasheets; confirm the current sheet before ordering.
Part numbers and Fortinet list prices for each model above (and the 901G) are on our FortiGate models pages.
How We Size
Headcount is a weak predictor. A 15-person engineering firm on a 2 Gbps circuit needs more firewall than a 60-person warehouse on 300 Mbps. Start with the circuit.
Take the internet speed you pay for and require threat-protection throughput of at least 70 percent of it. A 300 Mbps circuit fits a 30G. A 500 Mbps to 1 Gbps circuit fits a 50G or 70G. Above 1 Gbps, or with a second circuit for SD-WAN, start at the 90G. Sizing to the bare firewall number is the most common mistake we see; it is 5 to 10 times higher than what you get with security services enabled.
If the firewall is the only switch in a small office, the 70G’s ten gigabit ports and the PoE variant’s four powered ports matter more than throughput. If a managed switch sits behind the firewall, two WAN ports and one or two LAN uplinks are all you use, and a 50G is fine.
Only the 90G has multi-gig and SFP+ ports. If your core switch has 10G or 2.5G uplinks, or you run a server VLAN with 10G hosts, a gigabit firewall becomes the bottleneck for east-west traffic that routes through it. That is the usual reason a 40-person office lands on a 90G.
Hardware is a small share of five-year cost once FortiGuard subscriptions are included, and the G-series has no published end-of-order date. Pick the model that still fits after the next circuit upgrade. Dropping from a 90G to a 70G to save a few hundred dollars is a false economy if the circuit doubles in year two.
Typical Fit
User bands are Fortinet’s own, from the SMB Quick Sizing Guide (October 2024 edition). The circuit and site columns are our deployment patterns. Where the two disagree, the circuit wins.
| Model | Fortinet user band | Internet circuit | Typical site | Usually chosen when |
|---|---|---|---|---|
| 30G | 1 to 15 | Up to 300 Mbps | Branch, retail, small clinic, home office of a remote executive | SD-WAN spoke behind a hub; budget-driven; few devices |
| 50G | 10 to 25 | 300 Mbps to 1 Gbps | 10 to 30 people, one managed switch, a few access points | Switch handles the LAN; firewall only routes and inspects |
| 70G | 20 to 50 | 500 Mbps to 1 Gbps | 10 to 50 people, firewall doubles as the switch, PoE for a few APs or phones | No separate switch, or two WAN circuits for failover |
| 90G | 40 to 80 | 1 Gbps and up, or dual circuits | 30 to 150 people, 10G core switch, server VLAN, regulated inspection policy | Multi-gig uplinks, SSL inspection on most traffic, HA pair |
| 120G | 50 to 150 | Multi-gig, dual circuits | Larger office or small campus with a 10G core | Four SFP+ ports needed; next step above the 90G |
What About the 40F and 60F
The 40F, 60F and 61F have no published end-of-order date and run FortiOS 8.0. They are 2 GB-RAM models, and Fortinet has been removing features from that class: proxy-mode features in FortiOS 7.4.4, SSL-VPN in FortiOS 7.6. If you need either, or you want hardware that will not lose features mid-life, buy the G-series equivalent: 40F → 30G or 50G, 60F → 70G. Our FortiGate end of life page has the dates and the Trade-Up replacement matrix.
Licensing and HA
One feature note first: the 30G, 50G and 70G do not support SSL-VPN at all, and the 90G only on a narrow FortiOS 7.0 range. Remote access on the G-series is IPsec or ZTNA, which is where Fortinet is taking the whole product line; plan the SSL-VPN migration as part of the purchase. Every model ships as hardware only or as a bundle with FortiCare support and FortiGuard security services for one, three or five years. The threat-protection numbers above assume those services are licensed and enabled; a FortiGate without FortiGuard is a router with a firewall policy.
FortiCare Premium plus FortiGuard security services such as antivirus, IPS, application control and web filtering. On 30G/50G, Fortinet’s datasheets note that Content Disarm and Reconstruct, DNS/video filtering and inline CASB are not available, so we confirm feature fit before quoting. The right bundle for most offices. Three-year terms cost less per year than one-year and avoid a renewal lapse, which Fortinet backdates.
Adds sandboxing, IoT detection and other services. Worth it for regulated sites that need the extra evidence; usually not for a 20-person office.
Two identical units in active-passive. Each needs its own subscription. We pair 70Gs or 90Gs; below that, a single unit with a four-hour hardware replacement contract is the better spend.
We register the unit to your Fortinet account, not ours, so renewals and RMA stay yours. Used units from auction sites cannot be transferred or supported; buy through an authorized partner.
Track Record
We only do networks. That is not a limitation — it is why the outcomes are different.
Years of network-only practice. Architecture, security, and operations — not IT generalism.
Sites delivered. Healthcare clinics, law offices, financial branches, multi-site operations.
Design target for fully redundant builds with HA firewalls, diverse ISPs, and backed-up power.
Senior engineer–led. No junior handoffs. No ticket queue. No escalation chain.
Career aggregate. The 20+ years and 300+ sites span the operator’s full network-only practice, including prior-employer engagements. 99.99% availability, about 53 minutes of downtime per year, is an architecture design target for engagements that fund full redundancy. It is not a service guarantee or uptime SLA. Contracted response times and service levels are defined in each customer agreement.
Where We Work
Pre-staging and configuration happen remotely; cutover is on site or remote-hands guided, your choice. Local clients: see our Fortinet MSP in Sacramento and Fortinet MSP in San Francisco pages. Replacing a non-Fortinet firewall? See firewall migration. Want it watched afterward? See network monitoring.
FAQ
Start from the internet circuit, not the headcount. With full security profiles on, a FortiGate 50G handles about 1.1 Gbps of threat-protection throughput and a 70G about 1.3 Gbps, so either covers a 500 Mbps to 1 Gbps circuit for 20 people. The 70G adds ten gigabit ports and a PoE variant; the 50G has five. If you have one switch and no PoE needs, the 50G is enough. If the firewall is also the core switch for a small office, take the 70G.
Inspection capacity and uplinks. The 90G rates 4.5 Gbps IPS and 2.2 Gbps threat protection against 2.5 and 1.3 Gbps on the 70G, and it adds two shared-media pairs that take 10G, 5G or 2.5G copper or SFP+ fiber. If your core switch has 10G uplinks or your circuit exceeds 1 Gbps, the 90G is the smallest G-series that keeps up. The 70G is the right box for a gigabit office with gigabit switching.
For a site on a 100 to 300 Mbps circuit with a handful of users, yes. Its threat-protection throughput is 500 Mbps with all profiles enabled, and it has four gigabit ports. It is not the right choice if the circuit is 500 Mbps or faster, or if you plan to run SSL inspection on most traffic.
Buy the 70G unless you depend on SSL-VPN and cannot move off it yet. The 60F is still sold and supported on FortiOS 8.0, but it is a 2 GB RAM model: FortiOS 7.4.4 removed proxy-mode features and FortiOS 7.6 removed SSL-VPN from 2 GB models, so the 60F loses it on upgrade anyway. The 70G is current-generation SP5 hardware; it never had SSL-VPN, so remote access is IPsec or ZTNA from day one. For a five-year purchase the price difference is small.
They are Fortinet's datasheet figures measured with an enterprise traffic mix and specific profile sets. Real throughput depends on which profiles you enable, how much traffic you SSL-inspect, and session rate. We size to threat-protection throughput at roughly 70 percent of the circuit speed, then check sessions per second and concurrent sessions against the datasheet.
All four support FortiGate high availability in active-passive mode with identical units. Each member needs its own FortiCare and FortiGuard subscription. For small offices we usually pair a 70G or 90G; a 30G or 50G HA pair rarely makes sense because the budget is better spent on a single larger unit with a four-hour replacement contract.
For most businesses the Unified Threat Protection bundle: FortiCare Premium plus FortiGuard security services such as antivirus, IPS, application control and web filtering. On 30G/50G, Fortinet’s datasheets note that Content Disarm and Reconstruct, DNS/video filtering and inline CASB are not available, so we confirm feature fit before quoting. Buy one or three years. The Enterprise Protection bundle adds sandboxing and other services most small offices will not use. We quote the exact Fortinet part number so the term and the contents are unambiguous.
Yes. Send the circuit speed, user count, switch and access-point count, whether you need PoE from the firewall, and what the firewall must do (VPNs, SD-WAN, HA). We recommend a model, quote hardware and licensing at Fortinet list through our distributor, and run the migration as a fixed-fee project.
Sources
Last reviewed 2026-10-06. Fortinet revises datasheets and bundle contents; confirm the current sheet and part number before ordering.
Fortinet, FortiGate, FortiOS, FortiGuard, and FortiCare are trademarks of Fortinet, Inc. Ambio Edge Networks is an independent Fortinet partner and is not affiliated with or endorsed by Fortinet.
Automated 24/7 monitoring and alerting to your Slack, Teams or email and to us, configuration backups, a monthly report, and next-business-day response from a senior engineer (Mon–Fri, 8–6 Pacific). Up to 10 managed devices.
No change hours are included. Standard remote changes you ask for bill at $225/hr, 30-minute minimum; larger engineering work is quoted first. Hardware, licensing and migration are quoted separately.
One-time monitoring launch: $3,500 for the first site (dashboard, alert routing, baseline, runbook). Faster response and included change hours are on the Secure and Compliance plans.
Start with a fixed-fee network risk assessment, or read how managed network monitoring works.
Get a Sizing Recommendation
Tell us the internet speed, user count, switches and access points, whether the firewall must supply PoE, and what it has to do (VPNs, SD-WAN, HA). We recommend a model, quote hardware and licensing at Fortinet list, and run the migration as a fixed-fee project.
Response from a senior engineer within 1 business day.
A direct conversation — no sales team, no runaround.
An honest assessment of whether we are the right fit.
Clear next steps if we are — no pressure if we are not.
