FortiGate 40F vs 60F vs 70G: How to Size a Firewall for a Singapore SME

For most Singapore SMEs, the firewall is the single most important security purchase, and also the one most often sized by guesswork. Fortinet's FortiGate entry models are the common choice, and the question is usually which one. Here is how we approach it.

Shop by threat protection throughput, not firewall throughput

Every FortiGate datasheet lists several throughput numbers. The biggest one, firewall throughput, measures traffic passing with no inspection, which is not how you will run it. Once you turn on intrusion prevention, antivirus, web filtering and application control, the figure that matters is threat protection throughput, which is a fraction of the headline number. If you plan to inspect encrypted traffic, check the SSL inspection figure too.

A simple rule: choose a model whose threat protection throughput comfortably exceeds your internet bandwidth. If you have 1 Gbps fibre and expect to keep full protection on, size for that, not for the gigabit marketing number.

The three entry models compared

User counts are a rough guide only. A 20-person design studio moving large files to the cloud can need more firewall than a 50-person office doing email and web. Check the current datasheet figures against your bandwidth and confirm with us before ordering.

Links: FortiGate 40F, FortiGate 60F with UTP, FortiGate 70G.

Hardware alone is not a security service

FortiGate units are sold either as hardware with FortiCare support only, or bundled with FortiGuard security services. The difference matters:

• Hardware + 24x7 FortiCare: firmware updates and technical support, but no up-to-date threat intelligence. The box still firewalls and routes, but without current IPS signatures, antivirus or web filtering.
• Unified Threat Protection (UTP): adds FortiGuard IPS, antivirus, web and DNS filtering, application control and antispam on top of FortiCare. This is what most SMEs actually need.

Budget for renewal. Security subscriptions are annual or multi-year, and a lapsed subscription quietly turns a next-generation firewall back into a basic router. Multi-year bundles usually work out cheaper per year.

Features SMEs actually use

• SSL VPN or IPsec VPN for remote staff and branches.
• SD-WAN to balance or fail over between two internet lines, for example fibre plus a 5G backup.
• VLAN segmentation to keep guest Wi-Fi, CCTV and office PCs apart.
• FortiSwitch and FortiAP integration, which lets the FortiGate manage switches and Wi-Fi from one interface. See FortiSwitch and FortiAP.

When to buy a high-availability pair

A single firewall is a single point of failure. If an outage would stop sales, payments or production, consider two identical FortiGates in an HA cluster, so one takes over automatically if the other fails. For smaller offices, keeping a spare unit pre-configured is a reasonable middle ground.

Frequently asked questions

Is the FortiGate 40F enough for a 30-person office?

It can be for light web and email use on a modest internet line, but the 60F gives more ports and headroom for growth, VLANs and SD-WAN. Most offices of that size are better served by the 60F or 70G.

What happens when the UTP licence expires?

The firewall keeps passing traffic with its existing rules, but stops receiving new threat signatures and filtering updates. Renew before expiry to stay protected.

Do I need a separate firewall if my router has one?

ISP routers provide basic filtering but no intrusion prevention, malware scanning, or centralised logging. For a business holding customer data, a dedicated next-generation firewall is the expected baseline.

Browse the full Fortinet FortiGate range. SourceIT can quote hardware with 1, 3 or 5-year UTP bundles.