Room3.03Floor 3 Network and firewall
FortiGate firewalls: models, pricing, installation and setup
New FortiGate firewalls from an authorized Fortinet reseller, sized to your office, priced part by part, installed by our technicians across the GTA and set up to a hardening standard.
- Sized to your office
- Priced part by part
- Installed by our technicians
- Set up to a hardening standard
The right FortiGate, bought well and set up properly
IT Support Hub is an authorized Fortinet reseller in Toronto. We supply new FortiGate firewalls with their FortiGuard security services and FortiCare support, install them on site across the GTA, and set them up to a written hardening standard.
You get one quote, one team and a firewall that is documented from the first day.
Most FortiGate problems we are called in to fix trace back to how the firewall was first set up, not to the hardware. The admin page is reachable from the internet, there is one shared admin password and no multi-factor sign-in, the firmware is years old, or the security subscription lapsed and nobody noticed. A good installation prevents all four.
Already running a FortiGate and need help with it, or a renewal? Our Fortinet reseller and firewall support page covers support, renewals and the wider Fortinet range. This page is about choosing, buying and installing a new one.
Which FortiGate model fits your office
Size a FortiGate on its threat protection throughput, not the headline firewall number. Threat protection is the speed with intrusion prevention, malware scanning and application control all switched on, which is how a business firewall should run. It is a fraction of the firewall figure on every model, so a box that looks fast on paper can still slow down a busy office.
| Model | Threat protection | Firewall | Typical fit |
|---|---|---|---|
| FortiGate 30G | 500 Mbps | 4 Gbps | Very small offices, retail counters and home offices of senior staff |
| FortiGate 50G | 1.1 Gbps | 5 Gbps | Small offices on a gigabit internet line, with fibre, 5G and DSL versions |
| FortiGate 70G | 1.3 Gbps | 10 Gbps | Busy small and mid-size offices, with versions that power phones and access points |
| FortiGate 90G | 2.2 Gbps | 28 Gbps | Mid-size offices with faster internet, more networks and 10 Gb links to the switches |
| FortiGate 120G | 2.8 Gbps | 28 Gbps | Larger offices and head offices that need a rack-mounted unit with many ports |
Figures are from Fortinet’s published specifications. User counts depend more on how people work than on head count: an office that inspects encrypted traffic, runs video calls all day or has two internet lines needs more headroom than one that mostly sends email. We size from your internet speed, the number of devices and the features you will switch on, then add room for three to five years of growth.
Variants worth knowing about
- Models ending in 1, such as the 51G or 91G, add storage for keeping logs on the firewall itself
- FortiWiFi models add a built-in Wi-Fi 6 access point, useful in a small office with no separate Wi-Fi
- PoE versions power desk phones, cameras and access points straight from the firewall
- 5G and LTE versions give a backup internet connection, or the main one where no wired service exists
Models to avoid for a new install
The FortiGate 40F and 60F have 2 GB of memory, and recent FortiOS releases switch off features on 2 GB models, including SSL VPN and some proxy-based inspection. Fortinet has also set the 60F and 61F to stop being sold on January 13, 2027. They are still supported for years, but a new office should start on a G-series model.
What decides the price of a FortiGate
Over three to five years, the hardware is often the smaller part of what a FortiGate costs. The security subscription, the support level and the term you choose usually decide the total. That is why we quote every part on its own line and show you the alternatives, instead of a single bundle price you cannot compare.
| FortiGuard bundle | What it covers | Good fit for |
|---|---|---|
| Advanced Threat Protection (ATP) | Intrusion prevention, anti-malware with sandboxing, application control and FortiCare Premium support | Offices that filter web traffic another way, or a firewall at a second site |
| Unified Threat Protection (UTP) | Everything in ATP plus web, DNS and video filtering and anti-spam | Most small and mid-size offices |
| Enterprise Protection | Everything in UTP plus data loss prevention, inline cloud app control, attack surface checks and the FortiConverter migration service | Regulated offices, larger sites, and moves from another firewall brand |
Other things that change the quote
- Term length. Bundles are sold for one, three or five years, and the longer terms cost less per year.
- Support level. FortiCare Premium comes with every bundle. FortiCare Elite adds faster response on critical cases and longer firmware support, and suits firewalls the business cannot run without.
- A second unit for failover. A high-availability pair keeps the office online if one firewall fails, but the second unit needs its own hardware and licences.
- Switches and access points. FortiSwitch and FortiAP units are managed from the FortiGate itself, so there is no separate controller to buy.
- Logging. Keeping logs for months for audits or insurers usually means a cloud logging subscription or a model with storage.
- Installation. Our labour is quoted separately as a fixed price, so you can see exactly what the hardware and licences cost.
How we keep the price down
We size to what you will use, not the next model up. We line up renewal dates so every Fortinet licence renews on one day, check whether Fortinet is running a trade-up or project promotion your purchase qualifies for, and quote three- and five-year terms beside one-year so you can compare. Already holding a quote from someone else? Send it over. We will price the same parts and point out anything oversized, missing or not like for like.
What a FortiGate installation includes
A firewall swap should be the least eventful hour of your week. Almost all of the work happens before we arrive, so the visit itself is short and the old firewall stays on the shelf, ready to go back in, until everything has been tested.
- The FortiGate registered to your own FortiCloud account, so the hardware and licences belong to your business
- Firmware updated to a release Fortinet recommends for that model before the unit leaves our bench
- The full configuration built and checked in advance: internet connections, internal networks, firewall rules, remote access, site-to-site links and security profiles
- On-site installation at a time planned around your working day, with the cabinet tidied and every cable labelled
- Testing of internet access, each network, Wi-Fi, phones, printers, remote access and the applications your staff rely on
- A handover pack with a network diagram, the firewall rules in plain language, admin accounts, serial numbers and every licence expiry date
Connecting FortiSwitch or FortiAP units at the same time? They are set up from the FortiGate in the same visit. For the cabling and cabinet work around a new network, our network and firewall page explains what else we handle.
How we set up a FortiGate: our hardening standard
Fortinet firewalls are a frequent target because there are so many of them on the internet. In 2026 alone, the US cybersecurity agency added several FortiOS flaws to its list of vulnerabilities being exploited in real attacks, including a FortiCloud single sign-on bypass in January and a critical flaw in September. Fortinet patched each one, and a firewall set up the way it should be is far harder to reach in the first place. Every FortiGate we install gets the following.
- The admin page never reachable from the internet, only from the office network or through the VPN, with trusted-host limits on every admin account
- A named admin account for each person who manages it, multi-factor sign-in on all of them, and the default admin account disabled
- FortiCloud single sign-on for admin logins left off unless you actually need it
- Firmware on a release Fortinet recommends, with critical fixes applied promptly and automatic upgrades set on purpose rather than left at the default
- Remote access over IPsec with multi-factor sign-in, since SSL VPN tunnel mode is gone from current FortiOS. Our VPN support page explains the change.
- Separate networks for staff, guests, phones, cameras and servers, with traffic between them blocked unless a rule allows it
- Intrusion prevention, anti-malware, web and DNS filtering and application control switched on, with encrypted-traffic inspection where it adds value and the certificate pushed to company devices
- Sign-ins to the VPN and admin page accepted only from countries you work in
- Two internet lines balanced with health checks where the office has them, so one failing does not stop work
- Logs sent off the firewall, with alerts on admin logins and configuration changes
- A configuration backup stored off the firewall after every change, and every FortiGuard expiry date on our renewal calendar
Replacing an older FortiGate or another brand
Many GTA offices are still running FortiGate E-series units bought six or more years ago. The FortiGate 60E reaches end of support on December 29, 2026, after which Fortinet stops issuing fixes for it, and other E-series models are already past that point. The 70F is no longer sold, and the 60F follows in January 2027.
Replacing on your own schedule costs less than replacing after a failure, when the only unit in stock is the expensive one.
Moving from SonicWall, WatchGuard, Sophos, Cisco ASA or Meraki is just as common. Fortinet’s FortiConverter service, included in the Enterprise Protection bundle, can translate an existing configuration to FortiOS. We use it as a starting point and review every rule, because ten years of firewall rules usually include plenty that nobody needs any more.
The old firewall’s licences, remote access users and site-to-site links are listed before anything changes, and the cutover is planned so the office is never without internet for long. Our Fortinet migration notes cover larger multi-site moves.
Support after the installation
FortiCare Premium covers the hardware, firmware access and Fortinet’s own technical support for the term you buy. Day-to-day changes, troubleshooting and firmware updates come from us. On the managed IT plan, help desk calls about the network and on-site visits when something breaks are included, and new hardware and licences are quoted separately.
- New FortiGate supplied, installed and hardened for an officeFixed quote
- Replacement of a FortiGate E-series or 60FFixed quote
- Move from SonicWall, WatchGuard, Sophos or Cisco to FortiGateFixed quote
- High-availability FortiGate pair for a head officeFixed quote
- FortiGate with FortiSwitch and FortiAP for a new officeFixed quote
- Security review of an existing FortiGate setupFixed quote
Questions people ask
How much does a FortiGate firewall cost?
It depends on the model, the FortiGuard bundle and the term. Over three to five years the subscriptions often cost more than the hardware, so we quote each part on its own line, with one-, three- and five-year options side by side.
Which FortiGate do I need for my office?
Start from the threat protection figure, not the firewall figure. A 30G suits a very small office, a 50G or 70G suits most small and mid-size offices, and a 90G or 120G suits busier sites with faster internet. We size from your internet speed, devices and the features you will use.
Is the FortiGate 60F still a good buy?
Not for a new install. It has 2 GB of memory, which limits features on current FortiOS, and Fortinet stops selling it on January 13, 2027. It stays supported for years, but a 50G or 70G is the better starting point today.
What happens if our FortiGuard subscription expires?
The firewall keeps routing traffic, but the services in the bundle stop updating or stop working, depending on the service. Intrusion prevention and malware signatures go stale, and web filtering may stop. We track every expiry date so renewals are quoted well before they lapse.
Do we need FortiCare Elite?
Most offices are well served by FortiCare Premium, which comes with every bundle. Elite adds faster response on critical cases and longer firmware support, which is worth it for firewalls the business cannot run without.
Can you set up a FortiGate we bought somewhere else?
Yes, as long as it is genuine new equipment that can be registered and covered by FortiCare. We check the serial number and licence status first, then set it up to the same standard as one we supply.
How long does a FortiGate installation take?
The configuration is built and tested before we arrive, so a single-office cutover usually takes a few hours on site. The old firewall stays ready to go back in until everything has been tested.
Can you replace our SonicWall or Cisco firewall with a FortiGate?
Yes. We use Fortinet's conversion tools as a starting point, then review every rule so only what you still need moves across. Remote access users and site-to-site links are planned before the switch so the office is never offline for long.
Tell us what’s going on
Pick how urgent it is and leave a way to reach you. The help desk replies by phone or email. If work has stopped, call 647-812-3775 instead.
Something broken, or something to plan?
For anything urgent, call. A technician answers the emergency line 24/7. For everything else, open a ticket and tell us what is going on.