How to Size a FortiGate (Reading the Datasheet)
Do not size a FortiGate from the “firewall throughput” number on the datasheet. That figure is measured with little or no security inspection. For a Singapore office, start with threat protection (and SSL inspection if you decrypt HTTPS), then check concurrent sessions, VPN capacity and ports. Ask your reseller to size against the features you will actually license and use.
Megatron Technology Pte Ltd, Singapore. We size and supply Fortinet.
Related pages: Fortinet · FortiGate conserve mode on small units · FortiGate vs Meraki MX for Singapore offices · Knowledge base
Why datasheet columns look so different
Fortinet publishes several performance columns because they measure different jobs. Mixing them up is how offices buy a unit that “should do 1 Gbps” and then struggle once IPS, antivirus and web filtering are on.
| Column (typical label) | What it roughly means | Use it when… |
|---|---|---|
| Firewall throughput | Forwarding capacity with minimal inspection | Almost never as the primary size for an office NGFW |
| IPS / NGFW throughput | Inspection with intrusion prevention and (for NGFW) application control in Fortinet’s test mix | You run those features but not full malware stacks |
| Threat protection throughput | Firewall + IPS + application control + malware protection (per Fortinet datasheet footnotes) | You bought a security bundle and will use it — the usual office starting point |
| SSL inspection throughput | Capacity while decrypting HTTPS (often a separate test) | You do deep HTTPS inspection for users or servers |
| IPsec VPN throughput | Encrypted tunnel capacity under Fortinet’s VPN test | Site-to-site or many remote IPsec users dominate the load |
| Concurrent sessions / new sessions per second | How many connections the box can track | Busy offices, many short-lived cloud connections, or chatty IoT |
Treat every Gbps figure as an “up to” lab result under perfect conditions, not a guarantee for your traffic mix. Open the current datasheet for the models you are comparing, note the as-of date on the PDF, and compare like-for-like columns.
How should a buyer read the sheet?
Write the real requirement. Internet speed today and planned; approximate users and devices; VPN user count; whether you will decrypt HTTPS; which FortiGuard features must stay on.
Pick the constraining column. For most offices with UTP/ATP-style inspection, that is threat protection. If SSL deep inspection is mandatory, also check the SSL inspection line — it is often the tighter limit.
Add headroom. Leave room for growth, logging, and traffic that is “harder” than a lab mix (lots of small HTTPS flows). Account for the next 3-5 years (lifecycle of the unit).
Check ports and form factor. Multi-gig WAN, HA interfaces, PoE needs and rack vs desktop all matter as much as Gbps.
Ask for a sized quote. A good reseller explains which column they sized on. A quote that only says “this model does X Gbps firewall” is incomplete.
What goes wrong when you size on the wrong number?
Undersized units with full inspection enabled can run hot on CPU or memory. On small desktop models that can show up as conserve mode — FortiOS reducing some inspection to protect stability. See FortiGate Conserve Mode on Small Units. If you are renewing an ageing 40F/60F after an internet upgrade, also read FortiGate 40F/60F Refresh: When Singapore Offices Should Move to G-Series.
Buyer checklist to send your reseller
Current and planned ISP speeds (per site)
Staff, guest and device counts
Remote VPN users and preferred access method
Whether HTTPS inspection is required
Must-have FortiGuard features (web filter, IPS, AV, sandbox, and so on)
HA requirement and downtime tolerance
Current FortiGate model and firmware, if replacing
Frequently asked questions
Is “NGFW throughput” the same as threat protection?
No. On Fortinet datasheets, NGFW and threat protection are different test definitions (threat protection typically adds malware protection on top of the NGFW-style stack).
Can we size from user count alone?
User count helps, but internet speed and enabled features matter more. Twenty users on a 200 Mbps line are not the same as twenty users on 1 Gbps with full SSL inspection.
Do HA pairs change sizing?
Active-passive HA is mainly for availability, not double throughput. Size each unit for the full inspected load; licensing for HA is a separate topic — see FortiGate HA Needs Two Licences.
Get a FortiGate sized for your Singapore office
Megatron Technology Pte Ltd (est. 1990, UEN 199002644W) is a Singapore Cisco Networking Partner and Managed Services Provider, and a Fortinet reseller. We design, size, licence, procure, deploy and support Cisco Meraki, FortiGate, and Cisco Catalyst & Data Centre from 2 Kallang Avenue #08-17 CT Hub, Singapore 339407.