Buying a FortiGate Without FortiGuard: Are You Missing the Whole Point?

Largely, yes. Without a FortiGuard subscription, a Fortinet FortiGate is still a capable firewall, router and VPN gateway, and with a FortiCare support contract it even keeps application control. What it loses is everything that depends on current threat intelligence: new intrusion prevention and antivirus signatures, cloud sandboxing, and FortiGuard web and DNS filtering, which stops working entirely. By default, Fortinet says, a FortiGate whose web-filtering licence has lapsed drops web traffic it cannot rate, unless an administrator changes the setting to let it through unfiltered. The subscription is what turns the hardware into a next-generation firewall. At SourceIT, the FortiGate 50G costs S$1,168.80 as hardware only and S$1,819.20 with 1-year Unified Threat Protection (UTP), so the first year of security services plus 24x7 support adds S$650.40 (listed 30 Oct 2026).

What works with no FortiGuard subscription?

According to Fortinet's technical guidance, these keep working:

• Firewall policies, NAT and virtual IPs
• Static and dynamic routing, SD-WAN and high availability
• IPsec VPN, site-to-site and dial-up for remote staff
• VLANs, zones, link aggregation and traffic shaping
• Authentication through LDAP, RADIUS, SAML and MFA
• DHCP, SNMP and local, syslog or FortiAnalyzer logging
• FortiSwitch and FortiAP management from the firewall
• Static URL filters, local domain filters and external threat feeds you supply

Fortinet also lists items included with any FortiCare support contract, without a FortiGuard bundle, including application control, device and OS detection, the GeoIP and botnet IP databases, anti-phishing, PSIRT checks and local protection for the management interface.

What does each bundle add?

From Fortinet's FortiGate security bundles page and FortiGuard ordering guide (May 2026). Some features have model limits: video filtering and inline CASB are not available on the 30G and 50G series. OT security, SD-WAN services, FortiAnalyzer Cloud and SOC-as-a-Service are sold separately.

The hardware is the engine. FortiGuard is the fuel. Without it the engine idles, and slowly falls behind.

What happens when a subscription expires?

Fortinet's technical documentation describes it:

• The firewall, VPN, SD-WAN, routing and high availability keep working.
• Antivirus, IPS and application control keep running on the last signatures downloaded, but "new signatures will not be updated."
• FortiGuard web filtering and DNS filtering stop, because they need real-time lookups. By default web traffic is dropped when rating fails; if "allow when rating error" is enabled, it passes unfiltered instead.
• Cloud anti-spam and outbreak prevention stop.

So an expired FortiGate either blocks the web for everyone on Monday morning, or quietly stops filtering it, depending on a setting most offices never knew existed. Renew before the expiry date; our FortiGate licence renewal guide and Fortinet renewal page explain how.

When does hardware only make sense?

• A spare or high-availability unit, where licensing follows Fortinet's rules for HA pairs; ask us before ordering.
• A lab or training unit that does not protect real users.
• A pure VPN or SD-WAN gateway behind another inspecting firewall.
• Buying the licence separately, for example to align with an existing renewal date.

For a firewall protecting an office, buy it with a bundle. Multi-year bundles cost less per year: the 50G with 5-year UTP is S$3,798, against S$1,819.20 for one year.

Which bundle is right?

UTP suits most SMEs because web and DNS filtering block phishing and malware sites, the most common starting point for attacks. Enterprise Protection makes sense for organisations with regulated data, a need for DLP, or a higher risk profile. ATP, without web filtering, suits few offices today. How these services use AI is covered in AI vs AI: Can FortiGate Fight Hackers Using Artificial Intelligence?

Buying in Singapore

SourceIT supplies FortiGate hardware with or without UTP, with local warranty and a GST invoice: FortiGate 30G (S$766.80 hardware only; S$1,236, S$1,956 and S$2,626.80 with 1-, 3- and 5-year UTP), 50G (S$1,168.80; S$1,819.20, S$2,847.60, S$3,798), 70G (S$1,668; S$2,630.40, S$4,189.20, S$5,623.20) and 90G (S$3,796.80; S$6,094.80, S$10,593.60, S$15,104.40). Prices listed 30 Oct 2026; ask us about Enterprise Protection, renewals and HA licensing. Browse the FortiGate firewall collection. For a quotation, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.

Frequently asked questions

Does a FortiGate work without a FortiGuard licence? Yes. Firewalling, routing, IPsec VPN, SD-WAN and switch and access point management keep working, but IPS and antivirus stop updating and FortiGuard web and DNS filtering stop.

What happens to web filtering when the licence expires? It stops rating sites. By default, Fortinet says, web traffic is then dropped; if "allow when rating error" is enabled, it passes unfiltered.

What is the difference between ATP, UTP and Enterprise Protection? ATP covers IPS, antivirus and sandboxing. UTP adds web, DNS and video filtering. Enterprise adds AI-based inline malware prevention, data loss prevention and IoT detection.

Is application control included without a FortiGuard bundle? Yes. Fortinet lists application control among the services included with any FortiCare support contract.

How much does UTP add to a FortiGate 50G? At SourceIT on 30 Oct 2026, the 50G is S$1,168.80 hardware only and S$1,819.20 with 1-year UTP, a difference of S$650.40.