FortiGate G-Series Firewalls: Choose by Workload, Ports and Failover

A FortiGate G-series purchase should begin with the work the firewall must perform during the busiest hour and during a failure. The model number comes later. Two sites with the same internet connection can need different appliances because inspection, application behavior, VPN use and internal traffic are different.

This guide is a decision framework for selected branch and enterprise models, not a complete catalog or a hands-on benchmark. The cover shows conceptual appliances. Use the focused comparisons linked below once you have narrowed the requirements.

Start with a One-Page Requirement

Write a short brief that a network engineer and a purchasing team can both use. It should describe the traffic to protect, the physical connections, the software dependencies and the service that must survive an outage. An explicit requirement makes it easier to reject an inexpensive but incomplete quote.

A G-Series Shortlist, Not a Universal Ranking

The figures below are Fortinet's published threat-protection benchmarks, checked against its October 2026 matrix and product comparison. They are useful screening points, not guaranteed internet speeds. The suggested review focus is our editorial interpretation, not a vendor-prescribed user count.

This selection is not the entire G-series portfolio. Do not assume identical hardware architecture, features or release support across every appliance carrying the G suffix. Use the exact SKU and its current documentation in the final design.

For smaller appliances, continue with the 40F, 50G, 60F, 70G and 90G comparison. For the next sizing discussion, use our 90G vs 120G vs 200G guide.

Use Benchmarks Without Overpromising

A raw firewall figure, a threat-protection figure and an SSL-inspection figure describe different tests. Fortinet's matrix includes the workload definitions and footnotes. Compare the same metric across candidates and retain the underlying document with the purchase record so that later revisions do not obscure the original decision.

Suppose the busiest measured interval carries 700 Mbit/s of traffic that will receive the intended inspection policy. A planning assumption of 40 percent growth produces 980 Mbit/s before any additional operating margin. This is arithmetic for a hypothetical site, not a validated sizing formula or a recommendation that a particular model will pass.

Next examine the conditions the average conceals: many short connections, large transfers, authentication events, VPN traffic and logging. Use the combined workload in acceptance testing. Avoid adding separate maximum benchmark numbers together as though the appliance can deliver every maximum simultaneously.

Three Sites That Need Different Answers

A branch with a modest internet circuit

Begin with service continuity and remote support. A small appliance may be sufficient, but the plan should explain how the site recovers from a failed unit, how staff reach support and whether a second circuit is actually usable. Spending the entire budget on a larger firewall while omitting recovery arrangements may solve the wrong problem.

A growing office with substantial encrypted traffic

Measure the policy that the business intends to enforce, not only today's lightly inspected traffic. Include the clients and applications affected by certificate deployment or exclusions. If the rollout introduces inspection in stages, define the performance and application checks for each stage. The largest change may be operational rather than the chassis swap itself.

A campus edge or regional hub

Trace the aggregate paths and failure states. Traffic that normally reaches different appliances may converge after a circuit or device failure. Decide which applications must retain their normal service and which can tolerate reduced capacity. That business decision should drive the test, instead of assuming every connection must always run at line rate.

Port Count Is Only Part of the Design

Build a port map with the actual handoff type, intended speed, cable distance and transceiver on each end. Include management and HA connections separately from user-data ports. Check whether an apparent interface advantage remains useful after the required redundancy and uplinks are allocated.

Ask for the exact optics and cables on the bill of materials. A quote that omits them is not directly comparable with an installed solution. Also record rack space, power feeds and the installation environment. For a larger refresh, our 400G vs 400F migration guide examines why interface and upgrade requirements need to be reviewed together.

Firmware and HA Belong in the Buying Decision

Check the exact target model against the intended FortiOS release, release notes and management-platform compatibility. Do this before approving hardware. A model's presence in a sales portfolio does not establish support for every software train already used by the organization.

Fortinet's FGCP replacement guidance requires matching model, hardware and firmware prerequisites. Do not plan to replace one F-series member with a different G-series model inside an ordinary existing pair. Design and test the replacement deployment, including interface mapping and rollback, as a separate migration.

Remote access deserves its own review. If the project includes a firmware change, inventory the client workflow before scheduling it. Our SSL VPN to IPsec migration guide covers the upgrade-planning questions that are easy to miss in a hardware-only comparison.

Normalize the Quote

Request like-for-like terms: appliance quantities, security subscriptions, support period, replacement service, management, log retention, optics and deployment work. Establish what renews and when. Use our FortiGate licensing guide to structure the subscription discussion, then verify the current SKU contents with the supplier.

A practical comparison has an initial total and a total for the chosen ownership period. Keep recurring services visible instead of burying them in one number. Review the Fortinet price-list catalog for part-number discovery and obtain a current quote for the complete configuration.

Prove the Purchase Before Cutover

1. Reproduce the intended security policy and representative client traffic.
2. Confirm required applications work with the inspection policy enabled.
3. Measure busy-period responsiveness, sessions and resource use.
4. Exercise the agreed circuit and device-failure scenarios.
5. Verify logs reach the intended destination and are useful for investigation.
6. Rehearse recovery, backups and the rollback decision with the operational owner.

Record what was tested, what passed and what remains outside the test. This gives the buying decision a defensible basis and gives the support team a baseline after installation. A good G-series choice is the smallest complete solution that meets the documented requirement with justified room to grow.

Official Sources

• Fortinet Product Matrix: benchmark definitions and model comparison
• Fortinet firewall portfolio and threat-protection comparison
• FortiGate model-specific hardware documentation
• Fortinet FGCP cluster replacement requirements