A FortiGate firewall for small business is a Fortinet next-generation firewall (NGFW) appliance that combines firewalling, intrusion prevention, web filtering, malware protection and VPN in one box, managed from a single console. For most SMEs in Jordan and the GCC in 2026, the right choice is an entry model such as the FortiGate 40F, 60F, 70G or 90G with a Unified Threat Protection (UTP) subscription, sized on its threat-protection and SSL-inspection throughput rather than its headline firewall speed. Budget for yearly licence renewals, firmware patching and a tested configuration backup from day one.
What does a next-generation firewall do?#
A next-generation firewall is a firewall that inspects traffic by application, user and content, not only by IP address and port. A traditional firewall asks “is port 443 open?”; an NGFW asks “is this HTTPS session a legitimate Microsoft 365 connection, a personal file-sharing upload or malware calling home?”
A FortiGate typically combines these functions:
- Firewall and NAT: controls connections between the internet, LAN, servers and guest networks.
- Intrusion prevention (IPS): blocks known exploit attempts.
- Application control: allows business tools and limits risky apps.
- Web and DNS filtering: blocks phishing and malicious sites.
- Malware protection: scans files crossing the firewall.
- SSL/TLS inspection: decrypts encrypted traffic so the other engines can see inside it.
- VPN and SD-WAN: connects branches and remote staff and balances multiple internet lines.
Why it matters for smaller companies: Verizon’s 2025 Data Breach Investigations Report SMB snapshot found ransomware present in 88% of breaches at small and medium-sized businesses, compared with 39% at large organisations, and 98% of SMB breaches involved external actors. A well-configured NGFW is a practical first line against those attackers, alongside endpoint protection, backups and MFA.
How to size a FortiGate model correctly#
Sizing is where most buyers go wrong: Fortinet datasheets list several throughput figures, and the biggest is rarely the one that matters.
- Firewall throughput is raw forwarding speed with no security inspection, which is misleading at the internet edge.
- NGFW throughput is measured with IPS and application control enabled.
- Threat protection throughput is measured with firewall, IPS, application control and malware protection all enabled. It is the closest figure to a real UTP deployment.
- SSL inspection throughput is performance while decrypting and inspecting HTTPS traffic.
The gap is large. The FortiGate 70G’s published specifications list 10 Gbps firewall throughput but 1.3 Gbps threat protection throughput and 1.4 Gbps SSL inspection throughput, so designing on the headline figure would overestimate real capacity by more than seven times.
| Model | Threat protection throughput | SSL inspection throughput | Typical fit |
|---|---|---|---|
| FortiGate 40F | 600 Mbps | 310 Mbps | Compact fanless desktop for a small office or shop |
| FortiGate 60F | 700 Mbps | 630 Mbps | Small office that wants more SSL inspection headroom |
| FortiGate 70G | 1.3 Gbps | 1.4 Gbps | Growing office on gigabit fibre; PoE, Wi-Fi and SSD variants |
| FortiGate 90G | 2.2 Gbps | 2.6 Gbps | Busier head office, multiple lines or many VPN users |
Figures come from Nomios’s model overview and SHI and datacenter360 spec listings; confirm against Fortinet’s current datasheet before ordering.
A five-step sizing method#
- Add up your internet bandwidth across all lines, including any upgrade you expect in the next three to five years.
- Decide what you will inspect. If you plan deep SSL inspection, size on the SSL inspection figure, not threat protection.
- Add headroom. As a working rule, we suggest choosing a model rated at least 30 to 50 percent above your line speed for the features you will enable, so the firewall does not become the bottleneck.
- Count connections: VPN users, branch tunnels, guest Wi-Fi and IoT devices all consume capacity.
- Check hardware and lifecycle: port count, PoE, built-in Wi-Fi (FortiWiFi), local log storage (the 71G adds a 64 GB SSD) and end-of-order status. According to a 2026 lifecycle guide from Fortinet partner Ogma, the 70F, 80F and 100F reached end-of-order in 2026, with the 90G and 120G named as successors.
Example: an office on 500 Mbps fibre wanting full inspection would outgrow a 40F, whose 310 Mbps SSL inspection rating would throttle encrypted traffic; a 70G or 90G is safer.
FortiGuard licensing bundles explained#
The appliance alone forwards and filters traffic; FortiGuard subscriptions deliver the signatures and cloud services that make it a next-generation firewall. Fortinet sells them as bundles that include FortiCare Premium support. According to Fortinet’s service-offerings documentation, the current bundle names and contents are:
| Bundle | What it includes | Who it suits |
|---|---|---|
| FortiCare Premium only | 24×7 support and application control, with no IPS, malware or filtering services | Internal or lab use; not recommended at the internet edge |
| ATP (Advanced Threat Protection) | IPS, application control and advanced malware protection | Basic threat protection where web filtering is handled elsewhere |
| UTP (Unified Threat Protection) | Everything in ATP plus URL, DNS and video filtering and anti-spam | Most small and medium businesses |
| Enterprise Protection | Everything in UTP plus DLP, an inline CASB database, AI-based inline malware prevention and attack surface security | Regulated or data-heavy organisations |
In reseller part numbers, “950” indicates UTP (for example FG-60F-BDL-950-12), “928” ATP and “809” Enterprise Protection, and the final number is the term in months. Datacenter360’s listing notes that FortiCare Premium includes 24×7 support, firmware and signature updates and advance hardware replacement.
Typical market prices in 2026: US reseller SHI listed the FortiGate 40F with one year of UTP at USD 952 (MSRP USD 1,293), the 60F with one year of UTP at USD 979 (MSRP USD 1,552) and the 90G with one year of UTP at USD 4,084 (MSRP USD 5,550) in October 2026. Prices in Jordan and the GCC depend on the local distributor, customs and VAT, so treat these as reference points only.
Typical FortiGate setup steps#
- Register and activate the appliance and its licences in your Fortinet account, under your company’s name rather than an individual’s.
- Upgrade FortiOS to a current recommended release before you build the configuration.
- Lock down administration: replace the default admin, enforce MFA and never expose the admin page to the internet. CVE-2024-55591, an authentication bypass in the FortiOS 7.0 admin interface disclosed in January 2025, was reportedly exploited from November 2024, and the recommended workaround was restricting admin access, according to CyCognito.
- Segment the network with VLANs for staff, servers, guests, point-of-sale and IoT devices.
- Write least-privilege policies and attach security profiles (IPS, antivirus, web filter, application control) to each policy.
- Plan SSL inspection: choose certificate or deep inspection, deploy the certificate to company devices and exempt banking and health sites.
- Configure remote access on IPsec. Starting with FortiOS 7.6.3, SSL VPN tunnel mode was removed and Fortinet’s community guidance recommends migrating to IPsec VPN; add MFA for every remote user.
- Turn on logging and alerts to FortiGate Cloud or FortiAnalyzer so you can investigate incidents.
- Back up and document the configuration, store it off the device, and test restore and failover.
Common FortiGate mistakes to avoid#
- Buying on firewall throughput. The headline number assumes no inspection.
- Delaying firmware updates. CVE-2024-21762, a FortiOS out-of-bounds write that could allow remote code execution, was added to CISA’s Known Exploited Vulnerabilities catalog in February 2024, according to Help Net Security; the interim workaround was disabling SSL VPN.
- “Any to any” rules left in place after go-live, which cancel most of the protection you paid for.
- Deep inspection with no exemptions, which breaks banking apps and software updates.
- Letting FortiGuard lapse, so the box keeps routing but stops learning about new threats.
- No logs or log retention. Jordan’s Personal Data Protection Law No. 24 of 2023 took effect on 17 March 2024 and requires a controller to notify the regulator within 72 hours of discovering a serious breach, according to Clyde & Co, and Saudi Arabia’s PDPL has been fully enforceable since 14 September 2024. Without logs, you cannot say what happened.
Managed vs self-managed FortiGate#
A managed FortiGate service is an arrangement in which an IT provider configures, monitors, patches and changes your firewall under an agreed scope, while you keep ownership of the device and licences.
| Factor | Self-managed | Managed by an IT provider |
|---|---|---|
| Firmware patching | Your team tracks advisories and schedules upgrades | Provider tracks advisories and patches in agreed windows |
| Policy changes | Fast if you have a skilled admin, risky if not | Requested by ticket, email or WhatsApp and logged |
| Licence renewals | Easy to miss | Tracked and quoted ahead of expiry |
| Cost | Hardware and licences only, plus staff time | Hardware and licences plus a monthly or annual fee |
| Best for | Companies with an in-house network engineer | SMEs without dedicated security staff |
Either way, keep admin credentials and licences in the company’s name and keep a written change log, not just chat history.
How Consult One helps#
Consult One is an IT and digital agency based in Amman, Jordan, serving clients across Jordan, the GCC and the USA since 2004. Through our IT infrastructure and security service, we size, supply, configure and support FortiGate firewalls alongside our wider IT services, including Microsoft and Kaspersky licensing. We document every configuration and hand ownership to you.
Planning a new firewall or unsure whether your current FortiGate is sized and licensed correctly? Share your internet speeds, user count and sites, and we will recommend a model, bundle and support option. Get a free quote.
FAQ#
Is FortiGate a good firewall for small businesses?
Yes. FortiGate is a strong choice for small businesses because entry models such as the 40F, 60F, 70G and 90G combine firewall, intrusion prevention, web filtering, malware protection, VPN and SD-WAN in one appliance with a single management console. The key is buying the right size, keeping the FortiGuard subscription active and patching FortiOS regularly, either in-house or through a managed IT provider.
Which FortiGate model is best for a small office?
The best FortiGate model for a small office is the one whose threat-protection and SSL-inspection throughput exceeds your internet speed with headroom. Published specifications list about 600 Mbps threat protection for the 40F, 700 Mbps for the 60F, 1.3 Gbps for the 70G and 2.2 Gbps for the 90G. Also check ports, Wi-Fi, PoE, VPN users and the model’s lifecycle status before ordering.
What is the difference between FortiGate ATP and UTP?
ATP (Advanced Threat Protection) covers intrusion prevention, application control and advanced malware protection with FortiCare Premium support. UTP (Unified Threat Protection) includes everything in ATP plus URL, DNS and video filtering and anti-spam, according to Fortinet’s documentation. Most small and medium businesses choose UTP, while Enterprise Protection adds DLP, inline CASB and AI-based inline malware prevention for more regulated environments.
How much does a FortiGate firewall cost in 2026?
As a typical market range, US reseller SHI listed a FortiGate 40F or 60F with one year of UTP at roughly USD 950 to 1,550 in October 2026, and a 90G with one year of UTP at roughly USD 4,100 to 5,550. Prices in Jordan and the GCC vary with the distributor, customs and VAT, and installation and management are quoted separately.
What happens if my FortiGuard licence expires?
If your FortiGuard licence expires, the FortiGate keeps passing traffic under its firewall policies, but the subscribed security services stop receiving new signatures and cloud lookups, and you lose FortiCare support and firmware access. That means new malware, exploits and malicious websites may not be recognised. Track renewal dates and renew before expiry so protection never lapses.
