FortiGate Cloud: BYOL vs Marketplace
For FortiGate-VM in public cloud you usually choose BYOL (bring your own licence — bought via Fortinet/reseller, then applied to the VM) or marketplace PAYG (pay-as-you-go hourly from AWS, Azure, GCP, OCI, and similar). BYOL suits steady production VPC/VNet firewalls and flexible FortiGuard bundles; marketplace PAYG suits short-lived or bursty needs. Confirm current SKUs and marketplace offer names with your reseller — they change by cloud provider and by date.
Megatron Technology Pte Ltd (est. 1990), Singapore Cisco Networking Partner and Managed Services Provider, Fortinet reseller. CT Hub, Kallang.
Related pages: Fortinet · FortiGate vs Meraki MX for Singapore offices · Knowledge base
What problem are you solving in cloud?
Singapore teams often need a FortiGate in front of workloads in a VPC (AWS), VNet (Azure), or equivalent — site-to-cloud VPN, east-west inspection, or the same policy model they already run on-prem. The cloud firewall is still a FortiGate; the buying difference is who sells the Fortinet licence and how you are billed.
| BYOL | Marketplace PAYG (on-demand) | |
|---|---|---|
| How you buy | Licence/subscription from Fortinet channel (reseller); deploy the BYOL image | Subscribe in the cloud marketplace; hourly (and sometimes annual marketplace) billing |
| Who invoices Fortinet software | Your Fortinet reseller / Fortinet programme (e.g. term or FortiFlex) | Cloud provider bill (plus compute/network) |
| Typical fit | Ongoing production, aligned on-prem bundles, predictable renewals | Labs, PoCs, temporary projects, variable scale |
| Bundle flexibility | ATP / UTP / Enterprise-style choices via Fortinet ordering (confirm current) | Marketplace offers often package a fixed protection level (commonly UTM-class); higher bundles may require BYOL |
| Moving between types | Licence type is chosen at deploy time; switching usually means a new VM and config migration — not a toggle on the same instance |
Fortinet’s Cloud NGFW ordering materials (as of mid-2026 publications) describe BYOL term subscriptions and FortiFlex points, alongside public-cloud PAYG priced by vCPU hour on major marketplaces. Treat marketplace listing names and hourly rates as live data — check the cloud console and ask for a dated comparison rather than copying an old blog SKU.
Singapore buyer angle
Budget shape: BYOL is easier to put on an annual IT capex/opex renewal alongside appliance bundles. PAYG lands on the cloud bill — useful if cloud spend is the approved wallet.
Who owns renewals: BYOL renewals are your FortiCare/FortiGuard (or Flex) conversation with the reseller. PAYG continues until you terminate the marketplace subscription — someone must still own operational responsibility.
Compliance and accounts: Register support entitlements correctly so TAC can help. PAYG still needs proper FortiCare-style registration steps per Fortinet cloud docs.
Sizing: vCPU count drives both performance entitlement and cost. Pair cloud instance size with inspected throughput needs the same way you would on hardware.
FortiFlex in one paragraph
FortiFlex is Fortinet’s points-based way to entitle FortiGate-VM (and related VMs) with flexible vCPU and bundle mixes. It still sits on the BYOL side of the fence from a buyer’s point of view: you purchase Flex through Fortinet programmes/channel, then consume points as VMs run. It is worth asking about when you expect many short-lived or resizing cloud firewalls. It is not the same as clicking PAYG in a marketplace listing. Confirm current Flex rules and point calculators with your reseller — do not assume Flex SKUs from an old quote still apply.
Architecture notes buyers forget
Ingress/egress and routing — a FortiGate-VM only helps if traffic is steered through it (route tables, UDRs, GWLB/load-balancer patterns as designed).
High availability — two VMs in different zones still need correct licensing and failover testing.
Shared policy with on-prem — BYOL often makes it easier to keep the same bundle philosophy as your office FortiGates.
Egress costs — cloud data-transfer charges can dwarf a modest firewall licence if architecture chatty; ask your cloud team to model traffic, not only Fortinet SKUs.
Practical decision guide
Is this firewall needed for more than a few months at steady capacity? Start with BYOL.
Do you need Enterprise-class FortiGuard services that your marketplace PAYG offer does not include? Prefer BYOL.
Is this a PoC or seasonal burst? Marketplace PAYG may be simpler.
Already standardised on FortiFlex? Ask how Flex entitlements map to the cloud VMs you will run.
Confirm HA: cloud HA still implies licensing for each FortiGate-VM member unless a specific programme says otherwise — see FortiGate HA Needs Two Licences.
Frequently asked questions
Is “FortiGate Cloud” the same as FortiGate-VM BYOL?
Naming is easy to confuse. FortiGate-VM is the virtual NGFW you run in your cloud/hypervisor. “FortiGate Cloud” can also refer to Fortinet’s cloud management/logging services. Say which you mean on the quote request.
Can we bring an appliance licence to cloud?
Appliance and VM entitlements are different products. You cannot bring an appliance license to cloud.
Are marketplace hourly prices the whole cost?
No. You still pay the cloud provider for compute, disks and network, and you must size the instance. Invoice totals are often well below outdated list assumptions once programmes apply on BYOL — ask for a dated side-by-side.
Who should we buy through in Singapore?
For BYOL, a Fortinet reseller like Megatron Technology Pte Ltd. For PAYG, the marketplace is the cart — but a reseller can still help with architecture, HA, VPN back to your on-premise firewalls, and when to switch to BYOL. See Where to Buy FortiGate in Singapore.
Compare BYOL and marketplace FortiGate-VM for your VPC
Megatron Technology Pte Ltd is a Singapore networking specialist established in 1990 (UEN 199002644W), a Cisco Networking Partner and Managed Services Provider, and a Fortinet reseller, based at 2 Kallang Avenue, #08-17 CT Hub. We help you choose BYOL vs PAYG, size vCPU, and connect cloud FortiGates to your offices. Visit our Fortinet page or contact Megatron Technology.