A FortiGate firewall is rarely difficult to buy. The difficult part is buying the right appliance, subscriptions and support scope for the traffic, sites and applications it must protect. FortiGate consultants UK businesses rely on can close that gap, but only when their recommendation is based on measurable requirements rather than a default model or an oversized bill of materials.

For an IT manager, MSP or procurement team, the consultant should reduce risk at both stages: technical design first, then sourcing compatible hardware and licences at the right price. A good engagement produces a clear specification that can be quoted accurately across new, surplus or replacement equipment.

What FortiGate consultants UK should establish first

The starting point is not the number of employees. It is the way traffic moves through the organisation. A 100-user office with a 1 Gbps circuit, cloud applications, VPN users and SSL inspection may require substantially more firewall capacity than a larger site with simple outbound web access.

Ask the consultant to document the internet circuit speeds, expected growth, WAN topology, number of locations and remote users, public-facing services, VLAN count, wireless architecture and the applications that cannot tolerate disruption. If the firewall will sit at a branch, head office, data centre or cloud edge, that also changes the design.

Throughput figures need careful reading. Vendors publish different measurements for firewall throughput, IPS, threat protection, IPsec VPN and SSL inspection. The largest headline number is not a sizing answer. Once inspection services are enabled, usable performance can fall considerably. A consultant should state which services will be active and size the appliance for that realistic profile, with sensible headroom.

This matters particularly where organisations are replacing an older FortiGate. The existing unit may have been running with features disabled, overloaded CPU resources or a configuration that no longer reflects the business. Copying its model number or interface count can preserve the same limitation for another procurement cycle.

Look for design experience, not just product familiarity

Fortinet product knowledge is useful, but a viable deployment calls for wider network judgement. The consultant should understand routing, switching, DNS, identity services, wireless access, segmentation and the practical consequences of changing a perimeter device during business hours.

Ask direct questions about previous work that resembles your environment. An MSP may need multi-tenant visibility, standardised policy templates and predictable remote management. A manufacturer may need resilient industrial connectivity and tightly controlled vendor access. A professional services firm may be more concerned with secure hybrid working, Microsoft 365 traffic and resilient site-to-site connectivity.

Certification can be a useful signal, particularly where the engagement includes advanced FortiOS features. It is not, on its own, proof that the consultant can take ownership of a migration. Request an explanation of their proposed design in plain language: where the firewall will sit, what happens if a WAN link fails, how remote access will authenticate, and how traffic will be inspected without interrupting essential applications.

A credible consultant will also identify uncertainty. For example, encrypted traffic inspection improves visibility but can create certificate, privacy and application compatibility issues. SD-WAN can improve path selection and resilience, but it needs appropriately diverse circuits and testing against real application behaviour. There is no single best configuration for every site.

The discovery questions worth asking

Before accepting a proposal, make sure it answers the following points:

• Which FortiGate model is proposed, and what inspected throughput assumption supports that choice?
• Which FortiGuard services and licence term are included, and which security functions will actually be enabled?
• Does the design require SFP or SFP+ optics, copper interfaces, bypass options, rack hardware or spare power supplies?
• How will the current rules, VPNs, address objects, certificates and routing be migrated and validated?
• What is the rollback plan if a cutover affects critical access, and who is available during the change window?

These are commercial questions as much as technical ones. An attractive appliance price can become poor value if the quote excludes the subscription required for IPS, web filtering, antivirus, application control or support. Equally, paying for a high-end platform that will remain lightly used may take budget away from switches, wireless upgrades, backup connectivity or endpoint security.

Make licensing and support part of the purchasing decision

FortiGate hardware, FortiOS and FortiGuard subscriptions work together. A consultant should specify the exact bundle, duration and renewal responsibility rather than using vague terms such as “full security” or “enterprise protection”. Confirm whether the proposal includes hardware support, software updates, security intelligence services and a replacement arrangement in the event of failure.

For a small single-site business, a shorter subscription term may suit a planned technology refresh. For a multi-site estate, aligning renewal dates can reduce administration and make future budgeting easier. Neither route is automatically cheaper over time, so compare the full term cost rather than the appliance price alone.

Support expectations also need to be explicit. Vendor support and consultant support are different services. Vendor support may provide entitlement to updates and hardware replacement under the relevant service level. The consultant may provide configuration changes, incident response, monitoring, policy reviews or a managed firewall service. Establish who handles each task, response hours, escalation routes and whether out-of-hours support is charged separately.

If an MSP will manage the firewall, check access ownership from day one. The client should retain documented administrative access, configuration backups, licence information and a current network diagram. Dependence on a single supplier with no usable documentation makes future changes slower and more expensive.

Procurement details that prevent deployment delays

Once the design is signed off, procurement should verify the exact SKU and compatibility requirements. Interface types matter. A firewall with SFP+ ports may need compatible 10GbE transceivers or direct-attach cables, while existing infrastructure may use RJ45 copper, 1GbE SFP modules or fibre connectors that are not interchangeable.

Power, rack space and delivery location are equally practical concerns. Check whether the proposed appliance includes rack-mount ears, power cables suitable for UK installations and the required modules. For resilience, decide whether a cold spare is proportionate or whether a high-availability pair is needed. An HA pair delivers faster failover but introduces additional hardware, licensing, configuration and testing requirements.

Used or surplus enterprise hardware can be a sensible option for lab environments, temporary deployments, non-critical edge use or replacement planning. It should not be treated as identical to new stock. Confirm condition, warranty, included accessories, software entitlement position and whether the appliance can be registered and supported for the intended deployment. A consultant who understands the environment can help distinguish a cost-effective purchase from a false economy.

Keep the quotation separated into appliance, subscriptions, optics and accessories, implementation services, and ongoing support. That format makes comparisons far more meaningful. It also allows procurement to source compatible components competitively without losing sight of the design assumptions.

Insist on a tested handover, not a completed installation

A firewall change is not finished when traffic begins to pass. The consultant should test the agreed services: internet access, internal routing, site VPNs, remote-user VPN, DNS, business applications, failover and logging. Where SSL inspection or web filtering is enabled, test the applications most likely to be affected, including finance platforms, video conferencing, SaaS tools and third-party support connections.

The final handover should include the as-built configuration, a current policy set, device and licence details, diagrams, administrator access procedures and backup instructions. Agree a sensible rule-review schedule too. Firewalls often accumulate temporary rules that become permanent because nobody returns to them.

Choose clarity over the cheapest headline quote

The right consultant will not merely recommend a FortiGate model. They will explain the sizing basis, show the security and availability trade-offs, identify every required component and leave your team with a supportable system. That clarity gives buyers the confidence to compare hardware offers properly and deploy the equipment without last-minute surprises.