Performance Overview
Scores based on quantifiable specification values (1-10 scale)
Detailed Specifications
| Specification | FortiGate FG-40F Fortinet | FortiGate FG-50G Fortinet | FortiGate FG-70G Fortinet |
|---|---|---|---|
| Key Metrics | |||
| Firewall throughput | 5 Gbps | 5 Gbps | 10 Gbps |
| Threat Protection throughput | 600 Mbps | 1.1 Gbps | 1.3 Gbps |
| IPS throughput | 1 Gbps | 2.25 Gbps | 2.5 Gbps |
| NGFW throughput | 800 Mbps | 1.25 Gbps | 1.5 Gbps |
| Concurrent sessions | 700,000 | 720,000 | 1,400,000 |
| Total GE RJ45 ports | 5 | 5 | 10 |
| Throughput & Inspection | |||
| Firewall throughput (1518 byte UDP) | 5 Gbps | 5 Gbps | 10 Gbps |
| IPsec VPN throughput | 4.4 Gbps | -- | -- |
| SSL inspection throughput | 310 Mbps | -- | -- |
| IPS throughput | 1 Gbps | 2.25 Gbps | 2.5 Gbps |
| NGFW throughput (FW+AppCtrl+IPS) | 800 Mbps | 1.25 Gbps | 1.5 Gbps |
| Threat Protection throughput | 600 Mbps | 1.1 Gbps | 1.3 Gbps |
| New sessions/sec | 35,000 | -- | -- |
| Connectivity | |||
| WAN ports | 1 × GE RJ45 | 1 × GE RJ45 | 2 × GE RJ45 |
| LAN ports | 3 × GE RJ45 | 3 × GE RJ45 | 7 × GE RJ45 |
| DMZ port | -- | -- | 1 × GE RJ45 |
| FortiLink port | 1 × GE RJ45 | 1 × GE RJ45 | -- |
| SFP / SFP+ uplinks | None | None | None |
| 5G / LTE option | No | Yes (5G variant) | No |
| PoE variant | FG-40F-3G4G (LTE) | Yes (PoE variant available) | No |
| DSL variant | No | Yes | No |
| Security Services | |||
| SoC generation | SoC4 | SoC4 (G-series) | SoC4 (G-series) |
| Built-in SD-WAN | Yes | Yes | Yes |
| ZTNA enforcement | Yes (FortiOS) | Yes (FortiOS) | Yes (FortiOS) |
| SSL/TLS inspection | Yes | Yes | Yes |
| Application control & IPS | Yes | Yes | Yes |
| FortiGuard AI services | Yes | Yes | Yes |
| Integrated wireless controller | Yes (FortiLink) | Yes (FortiLink) | Yes |
| Form factor & Management | |||
| Chassis | Desktop, fanless | Desktop, fanless | Desktop, fanless |
| Acoustic profile | Silent | Silent | Silent |
| Rack-mount option | Optional tray | Optional tray | Optional tray |
| Management | FortiGate GUI, FortiManager, FortiCloud | FortiGate GUI, FortiManager, FortiCloud | FortiGate GUI, FortiManager, FortiCloud |
| FortiOS version | 7.x | 7.4+ (G-series) | 7.4+ (G-series) |
| Target deployment | Micro-site / small branch | Small branch with WAN diversity | Larger branch / SMB HQ |
Expert Analysis
The headline difference is straightforward: the 40F and 50G are physically near-identical 5-port desktop boxes, but the 50G's newer SoC4 silicon roughly doubles inspected throughput, while the 70G is a different class of appliance — ten gigabit ports, 1.4 million sessions and a 10 Gbps firewall plane aimed at sites the smaller two cannot comfortably serve.
The FG-40F is now the legacy option in this line-up. It still delivers credible NGFW performance for a micro-site — think a small UK retail unit, a satellite office of fewer than 25 users, or a home-worker setup for an executive — and it remains the cheapest way onto FortiOS with full FortiGuard services. But at 600 Mbps Threat Protection it will be the bottleneck on any site with a full-fibre 1 Gbps circuit once SSL inspection and IPS are switched on. If you are buying new today, the 50G is the more sensible floor.
The FG-50G is the most interesting box of the three for typical UK SMB branch use. Same footprint and port count as the 40F, but materially faster inspection (1.1 Gbps Threat Protection, 2.25 Gbps IPS) and — critically — available in 5G, PoE and DSL variants. That makes it the right pick for branches where the WAN story is messy: a 5G failover for an FTTP circuit, PoE for a couple of FortiAPs without a separate injector, or xDSL where fibre hasn't landed. The FG-70G steps up to a 10 Gbps firewall, ten GE ports and double the session table, which matters once you are aggregating wired users, wireless, guest and IoT VLANs on one appliance. Threat Protection only climbs to 1.3 Gbps, so the 70G is really about port density, headroom and session capacity rather than dramatically deeper inspection.
Recommendation framework: pick the 40F only if budget is the dominant constraint and the site is genuinely small and lightly inspected. Default to the 50G for new branch deployments under ~50 users, and specify the 5G or PoE variant where it removes adjacent kit. Move to the 70G when you need more than five copper ports on the firewall itself, when concurrent sessions matter (heavy SaaS, CCTV, IoT), or when a single site is consolidating wired, wireless and guest networks behind one FortiGate.
Ready to proceed?
Want to compare different products or add more to this comparison?
Open Interactive Comparison Tool →