A FortiGate appliance at a strong hardware price is only part of the security purchase. FortiGate licensing determines which security services, support level and update entitlement the firewall will receive after deployment. Buy too little coverage and a capable appliance can be left without the inspection, intelligence or vendor support your environment expects. Buy the wrong bundle and you may pay for services that do not match the site, users or risk profile.
For IT buyers replacing an ageing firewall, expanding a branch network or standardising an MSP estate, the practical question is not simply whether a licence is required. It is which service bundle belongs with the exact FortiGate model, for how long, and whether it aligns with your operating plan.
What FortiGate licensing actually covers
FortiGate hardware provides the firewall platform, interfaces, processing capacity and FortiOS operating environment. Licensing adds time-based access to selected FortiGuard security services and FortiCare support. The precise entitlement depends on the SKU purchased, so the product description and quote should always be checked against the appliance model and region before placing an order.
FortiGuard services can include capabilities such as intrusion prevention, anti-virus, web and DNS filtering, application control, IP reputation, sandboxing and threat intelligence feeds. These services are what allow the firewall to identify changing threats and apply current security categories and signatures. A firewall can still pass traffic without an active security subscription, but the level of protection and ongoing intelligence may be substantially reduced.
FortiCare is the support element. It commonly provides access to technical assistance, software and firmware updates, and hardware replacement terms appropriate to the support tier. Response targets and replacement arrangements vary by service level. A small office with an overnight maintenance window has different requirements from a distribution site or customer-facing service that cannot tolerate prolonged outage.
Do not assume that every FortiGuard feature is included in every bundle. Fortinet package names, included services and availability can differ by generation, model family and commercial programme. UTP, Enterprise Protection and 360 Protection are examples of bundle names buyers may encounter, but the correct choice must be confirmed from the current part number rather than a generic package label.
Choose coverage by deployment, not by headline price
The lowest-cost licence is not automatically the best value. Start with the firewall’s job. A FortiGate protecting a small, low-risk branch office may need core threat prevention, web controls and standard support. A unit at headquarters, a data centre edge or a site carrying sensitive customer data may justify broader protection, stronger support commitments and additional advanced threat services.
Think about the traffic you will inspect as well as the number of users. Enabling SSL/TLS inspection, IPS, anti-virus and web filtering places a real load on the appliance. Select the FortiGate model using security inspection throughput and expected feature use, not only firewall throughput or port count. A discounted unit can become a false economy if it cannot sustain policy enforcement at peak traffic levels.
Contract duration is another commercial decision. One-year terms provide flexibility where a site may close, merge or move to a different security design. Multi-year coverage can simplify renewals and may provide better overall procurement value when the appliance is part of a stable, longer-term deployment. The trade-off is reduced flexibility if requirements change.
For MSPs, consistency often matters as much as individual site cost. Standardising on a manageable set of FortiGate models and comparable licence levels makes monitoring, renewal forecasting and support escalation easier. It also reduces the risk of discovering that one customer site has a different entitlement level only when an incident occurs.
FortiCare tiers and service expectations
Support should be purchased against the consequence of failure. If the firewall is a single point of failure for internet access, VPN connectivity, voice services or payment systems, check the support tier carefully. The difference between next-business-day replacement and a faster replacement commitment can be significant when there is no spare appliance on site.
Before committing, confirm what applies to your specific contract: technical support hours, severity response objectives, firmware access, advance replacement eligibility, shipping arrangements and the service term. Hardware RMA logistics can vary by location and product, so do not base a business continuity plan on an assumption made from a headline support name.
A sensible alternative for critical locations is to hold a pre-configured spare or deploy high availability where the model and design support it. That adds capital cost, but it may be more suitable than relying solely on a support replacement process. Licensing does not replace resilience planning.
FortiGate licensing for used and replacement hardware
Used enterprise hardware can reduce refresh costs, particularly for lab environments, secondary sites and compatible replacements. However, FortiGate licensing requires extra due diligence when purchasing pre-owned equipment. Entitlements are associated with the appliance serial number and registration status, not simply with the physical chassis.
Ask for the exact model and serial details where appropriate, then verify whether the device can be registered to your Fortinet account and whether support or subscriptions can be renewed. Never assume an existing licence transfers with the unit, remains active after a change of ownership or can be moved to another appliance. Subscription terms, account ownership and transfer eligibility need formal confirmation.
Also check for the practical condition of the firewall: rack ears, power supplies, storage where applicable, included accessories and firmware compatibility. A low acquisition price is attractive, but it should be weighed against remaining service life, power consumption, support eligibility and the cost of the required licence. For a production firewall, a current model with a correctly matched multi-year bundle is often the cleaner purchasing decision.
Replacement scenarios need the same care. If a failed unit is swapped under support, confirm how the entitlement is handled for the replacement serial number. If you are buying a like-for-like spare independently, ensure the licence strategy covers the intended deployment rather than assuming the primary unit’s subscription can follow the hardware.
Avoid the common ordering mistakes
Most licensing problems begin before checkout. The first mistake is matching a service SKU to the wrong FortiGate model or hardware revision. Model names can look similar while their compatible subscriptions are not. The second is buying a renewal when the device has no eligible existing contract, or buying a new subscription when a renewal is the required commercial path.
The third is sizing around users alone. Fifty office users making cloud calls and inspecting encrypted traffic can create a very different demand from fifty users with light web access. The fourth is overlooking term alignment. If firewall, switch, wireless and support renewals all land in different months, budget control becomes unnecessarily difficult.
Provide the appliance model, required service term, deployment purpose and support expectation when requesting a quote. Where an existing FortiGate is involved, include its serial number and current entitlement status. This gives the supplier the information needed to validate compatibility before an incorrect SKU reaches your basket.
For buyers sourcing discounted Fortinet hardware through Green Code UK, that validation is especially valuable when comparing new, surplus and replacement stock. The best deal is the one that arrives ready to register, fits the network design and has the coverage needed for the full planned service period.
A better way to plan the purchase
Treat the FortiGate appliance, licence term and support requirement as one line of infrastructure rather than separate add-ons. Build the purchase around the expected inspected throughput, WAN links, VPN demand, ports, power requirements, redundancy approach and security policies you intend to enable. Then select the service bundle and support tier that make those features operationally realistic.
Before ordering, retain the final manufacturer part numbers, licence start assumptions and renewal date in your asset register. That small administrative step prevents surprise expiry and gives procurement a clear view of future costs. A FortiGate is most valuable when its hardware capacity, security services and support cover are bought to work together from day one.
