FortiGate 40F vs 60F vs 70F: How to Choose

Hiệp Cao · Updated Nov 10, 2026

Start with the port layout and the traffic the firewall will inspect. The 40F suits a simpler layout; the 60F and 70F provide more Gigabit copper ports and dedicated WAN and DMZ options. Compare VPN demand and security workload before selecting a model.

The content of the article

40F: when are five ports enough?

The 40F has one WAN, one FortiLink and three Gigabit LAN ports. Map every physical connection before ordering. If one port connects to a switch, decide which VLANs will share that trunk. If the design needs two dedicated WAN ports or more direct connections, compare the 60F and 70F.

60F and 70F: the same port count is not the same workload

Both provide two WAN, one DMZ and seven internal Gigabit ports, including A/B FortiLink. Compare Threat Protection, VPN and session capacity under equivalent Fortinet test conditions. If local logging matters, check an SSD-equipped variant such as the 71F rather than assuming the 70F includes storage.

When should a G-series model be shortlisted?

For a new deployment with a long planned service life, quote a comparable G-series model as an alternative. Check interfaces, enabled security features, lifecycle, support eligibility and renewal costs. A newer series is not an automatic drop-in replacement. Confirm availability separately.

A practical shortlist example

An office with two ISPs, a public-facing server and remote VPN users should map WAN and DMZ connections first. Estimate peak inspected traffic with IPS, web filtering or TLS enabled. Then check the design with one ISP down and test the business applications before committing where possible.

Model shortlist by ports and inspected throughput

Model shortlist by ports and inspected throughput
Model	GE copper ports	Threat Protection	Check before choosing
FG-40F	5	600 Mbps	One dedicated WAN; map interfaces if a second WAN is needed.
FG-60F	10	700 Mbps	Two WAN ports and DMZ; check VPN and TLS workloads.
FG-70F	10	800 Mbps	Same port count as 60F; consider if more inspection headroom is needed.

Fortinet Product Matrix

How to read the figures

These are Fortinet Threat Protection results for its Enterprise Mix test, not site throughput guarantees. Do not add VPN and Threat Protection rates together. Where deep TLS inspection is required, check the separate SSL Inspection figure and test with your policy set.

Example: do two 500 Mbps links require a 1 Gbps firewall?

Not automatically. With active/passive WAN, measure the primary link and simulate failover. With load balancing, calculate concurrent traffic subject to inspection; the two links can push the load above the figures shown. Measure both directions at peak and allow for growth.

What to send with a sizing request

List ISP speeds, failover mode, peak traffic, concurrent VPN users, inter-site traffic, IPS/TLS policies and spare interfaces. Ask for the exact hardware and subscription codes, lifecycle status and acceptance criteria.