Security inspection becoming the bottleneck

When an older firewall can route traffic quickly but slows under IPS, malware scanning, application control or TLS inspection, the network may need a platform sized around inspected throughput rather than raw firewall numbers.

Uplinks moving beyond 1GE

The 900G offers a mix of 25GE SFP28, 10GE SFP+, GE SFP, GE RJ45 and a 2.5GE HA interface, giving designers options for fibre and copper connections without relying on a single interface speed.

Growing session and connection rates

Large user populations, SaaS-heavy traffic, public services, NAT, VPNs and modern applications can create very high session counts. Session capacity and new-session rate should therefore be checked alongside throughput.

Too many separate network functions

FortiOS can combine routing, secure SD-WAN, firewalling and security controls in one appliance. Whether consolidation is appropriate depends on resilience, change-control boundaries and the organisation’s operational model.

Up to 164/163/153 Gbps firewall throughput depending on packet size in Fortinet’s current matrix.

Up to 42 Gbps IPS, 31 Gbps NGFW and 30 Gbps threat protection under Fortinet’s published test profiles.

Up to 16.7 Gbps SSL inspection throughput, which is a critical sizing figure for TLS-heavy environments.

Up to 28 million concurrent sessions and 720,000 new sessions per second in the current product matrix.

Measure the current network

Capture peak WAN traffic, encrypted traffic ratio, concurrent sessions, VPN usage, routing scale and security features already enabled.

Define the target architecture

Decide where the 900G sits, which zones it separates, whether HA is required, how internet and WAN links connect, and where logs are retained.

Build the bill of materials

Confirm FG-900G versus FG-901G, AC/DC requirements, transceivers, rack and cabling needs, subscriptions, support term and management platforms.

Plan configuration and migration

Document policies, routes, VPNs, authentication, objects, certificates, HA behaviour, rollback steps and an agreed test plan.

Validate after cutover

Check business applications, VPNs, security events, routing convergence, performance, logging, monitoring and documented recovery procedures.

Enterprise internet edge

Suitable where internet bandwidth and security inspection requirements exceed typical branch-firewall levels and where redundancy, multiple uplinks or high session counts are important.

Campus segmentation

Can enforce security boundaries between users, servers, guest access, administration, research, operational networks or other zones when the policy scale and traffic justify this appliance class.

Data-centre boundary

The 25GE and 10GE connectivity can suit selected data-centre edge roles where throughput, encrypted inspection and large session volumes are required without moving to a multi-RU chassis platform.

Large SD-WAN hub

May be considered for aggregation or hub roles where many sites, IPsec tunnels and application-aware WAN policies must be handled centrally. Tunnel scale and traffic concentration still need to be calculated.

High-traffic services

Session capacity and new-session rate can make the platform relevant to environments that experience high connection churn, provided the security policy and application architecture are also understood.

Firewall refresh projects

Organisations replacing older mid-range or enterprise FortiGate models may shortlist the 900G, but migration should be based on measured load, feature usage and future headroom instead of assuming a like-for-like model number.

Use real peak traffic plus growth and failover headroom, then map the design to NGFW, threat-protection and SSL-inspection figures instead of raw firewall throughput alone.

If local storage is required, confirm the 901G. Do not assume the base 900G includes the 960 GB storage shown for the 901G variant.

List the services the organisation actually needs and the preferred FortiCare level and term. A hardware-only appliance is not equivalent to a subscribed security bundle.

Identify every 25GE, 10GE, GE fibre and copper connection, transceiver, DAC and fibre type, then confirm supported accessories before purchase.

If yes, plan two matching appliances, subscriptions for the cluster, redundant switching and power, failover behaviour and a tested maintenance process.

Clarify whether the quote covers configuration review, policy migration, VPN migration, routing, testing, cutover support, documentation and post-change verification.

FortiGate 901G

Consider when the 900G class is appropriate but the deployment specifically requires the 901G’s listed 960 GB local storage. Confirm the exact use case and logging design.

FortiGuard security services

Select the protection package according to IPS, malware, web, DNS, application, OT or other security requirements. Service availability and bundling are subscription dependent.

FortiCare support

Confirm the desired support level and term for every production appliance, including HA cluster members, before finalising the purchase.

FortiManager and FortiAnalyzer

Central management and analytics may be relevant for multi-site policy control, logging and operations. Scope them separately according to architecture and retention needs.

Migration and configuration

A hardware refresh may also require policy cleanup, VPN migration, routing validation, HA setup, testing and documentation. Define these activities in the service scope.

Fortinet UAE planning

For broader Fortinet requirements beyond one appliance, review Fortinet solutions in the UAE and discuss how the firewall fits the wider network.

Answers buyers usually need before shortlisting the 900G

Buyers researching this model tend to move quickly from “what is the FortiGate 900G?” to more practical questions: whether it can carry a particular internet speed with security enabled, whether the 900G and 901G are functionally different, what licenses are needed, whether 25GE ports can fit an existing core, how much headroom is sensible, and what should be included in a quote. Those are better questions than simply comparing raw firewall throughput because they expose the dependencies that determine whether the appliance will work well in a real network.

For a 10 Gbps or multi-10-gigabit perimeter, the first decision is not whether 164 Gbps of firewall throughput looks large enough. The relevant check is what proportion of traffic will be inspected with IPS, application control, malware protection and TLS decryption. Fortinet’s current matrix gives separate figures for these workloads: 42 Gbps IPS, 31 Gbps NGFW, 30 Gbps threat protection and 16.7 Gbps SSL inspection. These numbers show why configuration context matters. A network carrying a high proportion of encrypted SaaS traffic can place different demands on the firewall from a network carrying large trusted data transfers with little inspection.

Another common point of confusion is the 900G versus 901G distinction. The current Fortinet matrix lists 960 GB of local storage for the 901G, not for the base 900G. This is important if the design expects local logging or other storage-dependent functions. It does not mean every deployment requires a 901G. Many enterprise designs send logs to FortiAnalyzer, a cloud service or a SIEM, but the destination and retention policy should be decided intentionally. If local storage is a requirement, put it in the bill of materials instead of assuming it comes with every 900G-series unit.

Licensing is another area where buying only by hardware price can create a poor comparison. The FG-900G can be sold as hardware and can also be bundled with FortiCare and FortiGuard services. The right package depends on the security controls the organisation intends to use and the support term required by its operations policy. If the project is an HA pair, both appliances should be considered together for registration and service licensing. A low initial hardware number is not an accurate project cost if the production design requires security subscriptions, optics, central management, implementation and support.

For replacement projects, buyers often ask whether a 900G is a suitable successor to an older enterprise FortiGate. The safest answer is to compare actual utilisation rather than model generations. Export traffic graphs, peak sessions, new-session rates, CPU and memory trends, VPN load, policy count and enabled inspection features from the existing firewall. Then add expected growth and a failover margin. This approach can show that a 900G is appropriate, oversized or insufficient without relying on a model-name shortcut.

How much spare capacity should we plan?

Enough to absorb realistic growth, bursts and a failed-peer condition if the firewall runs as an HA pair. The percentage cannot be chosen from a universal rule because businesses have different growth patterns and traffic peaks. Start with measured utilisation, add known projects such as new internet circuits or cloud migration, then verify that the inspected workload remains inside the chosen operating margin.

When should we choose the 901G instead?

Choose it when local storage is an explicit part of the design and the 901G’s 960 GB storage meets that requirement. If logs will be centralised elsewhere, local storage may not drive the decision. Confirm the operational reason for storage, retention expectations and any feature dependency before changing the SKU.

Do we need to buy transceivers separately?

Treat optics and DACs as separate bill-of-material items unless the exact package explicitly includes them. Record required speed, media, distance and connector type for each link, then match that requirement to Fortinet-supported transceivers for the 900G interfaces. This avoids discovering during installation that a core-switch optic or fibre path does not match the firewall design.

Should every cluster member carry the same security services?

For required FortiGuard services, Fortinet’s ordering guidance states that all units in the cluster must be registered and licensed because any member can become primary. Build licensing around the HA architecture rather than licensing only the unit expected to be active most of the time.

Can we migrate an old configuration unchanged?

A direct translation may be possible for many objects and policies, but a refresh is also an opportunity to remove obsolete rules, validate routes, modernise VPN settings and confirm identity or certificate dependencies. A conversion tool should not replace technical review, testing and rollback planning.

What should be included when asking FourTeck for a quote?

Provide the exact model, quantity, HA requirement, subscription package and term, FortiCare level, optics, power variant, destination, required timeline and whether configuration or migration assistance is needed. Include traffic data where possible. That lets the quotation reflect a usable deployment rather than a bare appliance with missing dependencies.

What type of firewall is the FortiGate 900G?

It is a 1RU physical Fortinet next-generation firewall designed for high-capacity enterprise secure networking. It combines FortiOS networking and security functions and can use FortiGuard services according to the selected license or subscription.

What is the difference between the FortiGate 900G and 901G?

The current Fortinet product matrix lists 960 GB of local storage for the 901G. The base 900G should not be assumed to include that storage. Confirm the exact SKU if local logging or another storage-dependent requirement is part of the design.

How much threat-protection throughput does the 900G provide?

Fortinet’s July 2026 product matrix lists up to 30 Gbps threat protection for the FG-900G under its Enterprise Mix test conditions. Actual performance varies with traffic, security features, logging, encryption and configuration.

Does the FortiGate 900G support 25GE interfaces?

Yes. The current product matrix lists four 25GE SFP28 ports, along with four 10GE SFP+ ports, eight GE SFP ports, seventeen GE RJ45 ports and one 2.5GE RJ45 interface. Confirm transceivers and port mapping for the intended design.

Are FortiGuard security services included with every 900G?

No. FortiGuard services and FortiCare support depend on the purchased SKU, bundle and subscription term. Ask for the exact service package required by the organisation rather than assuming all protection features are bundled with hardware-only pricing.

Can the FortiGate 900G be deployed as an HA pair?

FortiGate supports high-availability designs, but the project should include matching appliances, appropriate subscriptions, HA interfaces, redundant network paths and a tested failover plan. Fortinet requires cluster units to be registered and licensed for the required FortiGuard services.

Is the 900G appropriate for a 10 Gbps internet connection?

It may be, but sizing should use the intended inspection workload and not just internet circuit speed. Review threat protection, NGFW, SSL inspection, session rate, VPN load and failover headroom before deciding.

What information is needed for a FortiGate 900G quotation?

Provide model, quantity, HA requirement, license package and term, FortiCare level, optics, power variant, destination, target deployment date and any installation, configuration or migration services required.

Is the FortiGate 900G currently available in Dubai?

Availability should be confirmed for the exact SKU, quantity and subscription bundle at the time of purchase. Contact FourTeck for current UAE availability and vendor lead-time guidance rather than assuming stock or a fixed delivery date.

Can FourTeck assist with configuration or migration?

FourTeck can discuss configuration, migration, HA, routing, VPN, policy and deployment requirements as part of a defined service scope. The exact activities, customer inputs and deliverables should be agreed in the quotation.