FortiGate vs Traditional Firewall: What Are You Actually Paying For?

Mostly, you are paying for inspection and control, not for blocking. A traditional firewall, including the one built into most internet routers, is a stateful packet filter: it lets replies to your own traffic back in, blocks unsolicited connections and forwards ports you open. That is still useful, but it cannot tell a normal web page from a phishing site, a software update from malware, or Microsoft Teams from an unapproved file-sharing app. A next-generation firewall such as a Fortinet FortiGate adds intrusion prevention, antivirus and sandboxing, web and DNS filtering, application control and SSL inspection, plus business features such as IPsec VPN, SD-WAN and central management of switches and access points. Part of that comes with the hardware and support contract; the threat-intelligence services come from a FortiGuard subscription. At SourceIT, the FortiGate 50G is S$1,168.80 hardware only or S$1,819.20 with 1-year Unified Threat Protection (UTP) (listed 30 Oct 2026).

Traditional firewall vs FortiGate: feature by feature

FortiGate details from Fortinet's FortiGate security bundles page, FortiGuard ordering guide (May 2026) and Fortinet technical documentation.

What does the subscription actually buy?

Current threat intelligence. FortiGuard Labs, which Fortinet says analyses more than 100 billion security events a day, supplies the signatures, URL ratings, DNS ratings and reputation data the FortiGate uses. Fortinet sells three bundles:

• Advanced Threat Protection (ATP): IPS, antivirus, cloud sandbox and outbreak prevention.
• Unified Threat Protection (UTP): ATP plus web, DNS and video filtering and anti-botnet protection. This is the bundle offered with the G-series at SourceIT.
• Enterprise Protection: UTP plus AI-based inline malware prevention, data loss prevention, IoT detection and attack-surface rating.

Without one, the hardware still filters, routes and runs VPNs, but its security engines stop learning about new threats. Details are in Buying a FortiGate Without FortiGuard.

A traditional firewall decides who may knock. A next-generation firewall looks at what they are carrying.

Which throughput number should you look at?

The lowest one. Fortinet's October 2026 product matrix lists the FortiGate 50G at 5 Gbps firewall throughput, but 1.25 Gbps NGFW throughput and 1.1 Gbps threat protection throughput, which is the figure with IPS, application control and malware protection switched on. A traditional firewall's spec sheet shows only the first kind of number. Size a FortiGate by threat protection throughput against your internet line, and remember SSL inspection reduces it further: Fortinet lists 1.3 Gbps SSL inspection throughput for the 50G.

When is a traditional firewall enough?

For a home, or a one-person business with no customer data, a well-configured router with automatic updates may be acceptable, alongside good endpoint protection. Once a business has staff, customer personal data, remote workers, CCTV or more than one site, the case for inspection, segmentation and logging becomes strong, and CSA's Cyber Essentials standard expects a perimeter firewall that accepts only authorised traffic. See Why Your S$200 Router Isn't a Replacement for a Business Firewall.

What else should you budget for?

• Renewals. Buying three or five years up front is usually cheaper per year than renewing annually.
• Set-up. Policies, VPN, VLANs and SSL inspection need configuring properly; a default install leaves much of the value unused.
• Logging. Small FortiGates keep limited logs on the device; FortiAnalyzer or a cloud logging service keeps more.
• Hardware refresh. Plan a replacement when the model reaches end of support.

An earlier overview of the range is in Fortinet FortiGate Firewalls Unveiled, and the wider question of paying for subscriptions in Do You Really Own the Hardware If It Needs a Subscription to Work?

Buying in Singapore

SourceIT supplies the FortiGate G-series with local warranty and a GST invoice: FortiGate 30G (S$766.80 hardware only, S$1,236 with 1-year UTP), 50G (S$1,168.80 / S$1,819.20), 70G (S$1,668 / S$2,630.40) and 90G (S$3,796.80 / S$6,094.80), with 3- and 5-year UTP options. Prices listed 30 Oct 2026. Browse the FortiGate firewall collection. For a quotation, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.

Frequently asked questions

What is the difference between a firewall and a next-generation firewall? A traditional firewall filters connections by address and port. A next-generation firewall also inspects their content with IPS, antivirus, web filtering, application control and SSL inspection.

What does FortiGuard UTP include? Intrusion prevention, antivirus, cloud sandboxing and outbreak prevention, plus web, DNS and video filtering and anti-botnet protection, with FortiCare Premium support.

Which FortiGate throughput figure matters most? Threat protection throughput, measured with IPS, application control and malware protection on. For the FortiGate 50G, Fortinet lists 1.1 Gbps.

Does a FortiGate work without a subscription? Yes for firewalling, routing, VPN and SD-WAN, but its IPS, antivirus and filtering stop receiving updates, and category web filtering stops working.

How much does a FortiGate 50G cost in Singapore? At SourceIT on 30 Oct 2026, S$1,168.80 hardware only or S$1,819.20 with 1-year UTP.