FortiGate Licensing: ATP vs UTP vs Enterprise

A FortiGate quote can include the appliance, FortiCare support, individual FortiGuard services or a bundle such as ATP, UTP or Enterprise Protection. Those lines are easy to confuse because they are sold alongside the same serial number but solve different problems. This guide explains the current FortiGate licensing structure and shows how to choose a bundle without paying for services the deployment will not use.

FortiCare vs FortiGuard

FortiCare is the support relationship around the FortiGate. Depending on tier, it covers technical assistance, replacement service and entitlement to firmware and related support resources. FortiGuard is the family of continuously updated security services used by features such as antivirus, intrusion prevention, web filtering and DNS filtering.

A firewall can continue basic packet forwarding after some subscriptions expire, but the security posture changes because signatures, cloud lookups and licensed services may stop updating or operating. That is why “hardware-only” is rarely a complete internet-edge quote. Buyers should ask which protections the policy will enable, then make sure the subscription includes them.

ATP vs UTP vs Enterprise Protection

Fortinet's NGFW deployment guidance describes the bundles as a progression. Exact commercial packaging can change, so treat the table as a capability map and validate the current SKU before ordering.

ATP is not “basic support”; it is a security bundle. UTP is often the practical baseline for an office internet edge because web and DNS controls are common policy requirements. Enterprise Protection makes sense when the organization will actively use its additional controls and has the staff or managed service to operate them.

How to Choose the Right FortiGate Bundle

Choose FortiCare only when the role is intentionally narrow

A FortiGate used as an internal segmentation firewall, lab device or specialized VPN endpoint may not need the full internet-threat stack. Even then, document which updates and support rights remain available. Do not omit security services merely to reduce the initial quote if the production policy expects those services.

Choose ATP for core NGFW inspection

ATP is the shortlist when IPS, anti-malware and application control are required but user-facing web and DNS filtering are handled elsewhere. This may apply where secure web gateway or SASE services already provide those controls.

Choose UTP for a general business internet edge

UTP is often the easiest bundle to justify for offices, schools and branches because it extends the core security stack with web and DNS filtering. Those services help enforce acceptable-use policy and block categories or known malicious destinations without a separate platform.

Choose Enterprise Protection for broader integrated security

Enterprise Protection adds capabilities aimed at SaaS visibility, data loss, IoT and risk-oriented use cases. Buy it when those features map to a policy and an owner. A feature that is licensed but never configured does not improve security.

High Availability and Renewal Planning

For a conventional active-passive or active-active HA pair, budget support and security services for both appliances unless the exact order qualifies for a documented program that changes that rule. Fortinet has introduced specific licensing behavior for some versions and programs, but it should not be assumed for every cluster or commercial agreement.

Align contract end dates where possible. A pair with mismatched services can complicate failover, support and compliance. Also align the subscription term to the hardware lifecycle. A multi-year bundle can reduce annual procurement work, but a contract that runs beyond the appliance's planned replacement date can lock budget into the wrong platform.

What Happens When FortiGuard Services Expire?

The appliance does not simply become inert, but licensed security functions lose entitlement to current intelligence and updates. Fortinet documentation states that valid AV and IPS service licensing is required for the corresponding engine and signature updates. Web filtering, DNS filtering, sandboxing and other cloud-backed functions depend on their own entitlements.

Before a renewal date, export the service list from the FortiGate subscription view and compare it with the production policy. This prevents two opposite mistakes: renewing an expensive service no policy uses, or dropping a service that is enforcing a critical control.

FortiGate License Quote Checklist

1. Confirm the appliance SKU and whether it is a base, storage, Wi-Fi, PoE or cellular variant.
2. Map required policy features to ATP, UTP or Enterprise Protection.
3. Verify the FortiCare support tier and replacement objective.
4. Check the term, start date and renewal date for every serial number.
5. Include both nodes of an HA design unless a documented entitlement says otherwise.
6. Size performance with the licensed inspection services enabled.
7. Compare current bundle and renewal SKUs on https://globalpricelist.com/fortinet.

Hardware selection and licensing should be done together. The FortiGate 40F through 90G comparison shows how the inspection workload changes the appliance shortlist.

Sources

• NGFW Services and Licensing - Fortinet Document Library
• FortiGate Subscriptions - Fortinet Document Library
• FortiGate NGFW Portfolio - Fortinet