FortiGate 100F End of Life: Dates, the 120G and the Cost of Staying

The FortiGate 100F and 101F reached end of order on 16 April 2026. Fortinet support continues until 16 April 2031, and the last date to renew or extend a support contract is 16 April 2030. Both models still run current FortiOS, including 7.6 and 8.0.

So the box is not in trouble yet. The more useful questions are which 100F you actually have, what the successor changes in your rack, what another year on the old pair costs, and whether a mid-market site still needs a firewall this size at all. This page answers all four.

FortiGate 100F end-of-life dates

Fortinet announced end of life for the FortiGate 100F and 101F on 16 January 2026. End of order followed on 16 April 2026. The last service extension date is 16 April 2030 and end of support is 16 April 2031. Until then, units with an active contract receive support, firmware and security updates.

Source: Fortinet product life cycle. End of support follows end of order by five years; the last service extension date sits one year before end of support.

The FortiGate end-of-life timeline has the same dates for every other model, including the 60F and 40F.

What each milestone stops

End of order stops new hardware sales. Nothing changes for installed units. Replacement units under an advance replacement contract now come from existing stock.

Last service extension date is the last day Fortinet accepts a renewal or extension of FortiCare and FortiGuard for the model. After 16 April 2030 you can no longer buy coverage, so any contract you hold simply runs out.

End of support ends everything: technical support, hardware replacement, firmware and security updates. From 16 April 2031 a 100F still forwards traffic, but nobody fixes it.

Two software dates sit inside that window and often matter more. FortiOS 7.4 reaches end of engineering support on 11 May 2027 and end of support on 11 November 2028; the FortiOS 7.4 article covers that move. And FortiOS 7.6.3 removed SSL VPN tunnel mode on every FortiGate model. Fortinet's release notes say the settings are not upgraded from earlier versions and that customers must migrate before upgrading. If remote users still connect with FortiClient SSL VPN, that is your real deadline, not 2031.

Which 100F do you have? Generation 1 versus generation 2

Not every 100F is the same box. Fortinet's own technical tip distinguishes generation 1 units with 4 GB of RAM from generation 2 units with 8 GB. Run get hardware status on the CLI: a generation 1 unit reports about 3,614 MB of RAM and hardware revision Rev1, a generation 2 unit about 7,587 MB and Rev2.

The difference shows. According to the same tip, a generation 1 unit uses about 38% of its memory at factory defaults, against about 15% for generation 2. Add SSL inspection, proxy-based filtering and a busy SD-WAN configuration, and administrators on r/fortinet report 4 GB units entering conserve mode, the state in which the FortiGate protects itself by dropping new sessions and suspending inspection. If you run 4 GB units with proxy features, either move inspection to flow mode or move the unit up your replacement list.

The successor: FortiGate 120G, gains and losses

The FortiGate 120G (and the 121G with a 480 GB SSD) is the 1U model resellers and Fortinet partners position as the replacement. It is built on Fortinet's newer SP5 processor and roughly doubles most throughput figures. It also has fewer copper ports and no dedicated DMZ port.

Source: Fortinet FortiGate 100F and 120G series datasheets.

What you gain: almost three times the threat protection and SSL inspection capacity, twice the sessions, and four 10G uplinks instead of two. A site that pushed a 100F to its limits with full inspection on a gigabit line has headroom again.

What you lose is worth stating plainly. The 120G has four fewer copper ports and no dedicated DMZ interface, so a 100F with every copper port in use cannot be recabled one to one. Plan to reassign internal switch ports for the DMZ and to buy copper transceivers for the SFP slots if you need more RJ45. The 120G is also 2.2 kg heavier and runs warmer, which matters in a crowded wall cabinet. Early FortiOS 7.4 builds on SP5 hardware drew bug reports in the community, including IPsec issues where administrators disabled hardware offload as a workaround, so pick a mature recommended release before you go live.

What another year on the 100F costs

Staying on a 100F until 2030 is a legitimate choice. It has a price, and the licence is only part of it.

Reseller pricing: LicenseWise (Netherlands), October 2026, for the 100F lines; German reseller list prices for the 120G lines. Partner and trade-up pricing differs.

On those numbers, keeping a 100F HA pair under UTP costs about €13,000 over three years, for hardware that leaves support a year later. Buying two 120Gs costs a little more up front and restarts the clock. The rest of the cost of staying does not show on a quote:

• Refurbished replacements. Since end of order, replacement units come from depot stock. A generation 2 unit can come back as a generation 1 unit, with half the memory.
• Tokens that do not move. According to a Fortinet technical tip, FortiToken Mobile licences shipped on or after 4 August 2025 cannot be transferred to another device, except on RMA. Tokens bought for a 100F now will need to be bought again for its replacement.
• A remote-access migration you cannot skip. Staying current on FortiOS means losing SSL VPN tunnel mode, so the remote-access rebuild happens either way.

Fortinet's trade-up programme softens the switch. Units past end of order with valid services, or services that expired within the last 12 months, can move remaining support and security services to a new device listed in the trade-up matrix, through FortiCloud asset management, with a trade-up ID. Ask your partner for the trade-up SKU before you price a plain replacement. The managed firewall pricing guide puts these numbers next to other models.

Migrating a 100F that runs HA or acts as SD-WAN hub

A 100F is often the main site firewall, the hub of the SD-WAN, or both, usually as an HA pair. That makes the migration a cutover, not a swap.

Fortinet's clustering protocol does not mix models. In Fortinet's words: "All FortiGates in the cluster must be the same model and have the same firmware installed." You cannot add a 120G to a 100F cluster and fail over. The workable sequence:

1. Stage a new cluster alongside the old one. Rack the two 120Gs, connect only management, and bring them to the same FortiOS release the configuration was built on.
2. Translate the configuration. A 100F configuration file does not restore cleanly onto a 120G because the interfaces differ. Use FortiConverter or edit the interface mapping: the DMZ moves to a reassigned internal port, links on the shared ports 17 to 20 move to SFP slots, and the FortiLink ports map to the 120G's 10G ports.
3. Bring up routing passively. If the hub runs BGP or OSPF, peer the new cluster with a less preferred path so it learns routes without carrying traffic.
4. Cut over in one window. Move the WAN circuits and downstream links, make the new cluster preferred, and check that every SD-WAN spoke re-establishes its tunnels.
5. Keep the old pair racked. Leave the 100Fs powered off but cabled for a couple of weeks as a fallback.

Before the cutover, move remote access off SSL VPN tunnel mode, and settle the token question. Once the old pair is retired, the firewall decommissioning checklist covers licences, configuration backups and wiping the disks.

If remote access is the part you have to rebuild anyway, it is worth testing whether it needs to live on the firewall at all. You can try Jimber free with one user group while the 100F keeps running.

When the 100F should not be replaced like-for-like

Some sites need a firewall this size on site. Production sites with operational technology need local inspection of traffic between segments. Campus networks with heavy internal traffic, such as imaging or storage, need multi-gigabit routing between VLANs. Sites on limited or satellite links cannot send traffic to the cloud and back. For them, the 120G is the right call.

Many 100Fs do something else. They sit in an office where most applications are SaaS and staff work partly remotely, and they carry three jobs:

• Remote access, through FortiClient SSL VPN or IPsec. Fortinet's recommended replacement for SSL VPN is dial-up IPsec, which still gives users a route into the network and still needs an internet-facing gateway. Zero trust network access gives users specific applications instead, with no listening portal. The FortiOS 7.2 article covers how older branches handle this.
• Internet egress, with web filtering and SSL inspection. Remote users are often sent through the office first. A cloud secure web gateway inspects traffic close to the user.
• Connectivity between sites, as SD-WAN hub. That can move to cloud-delivered SD-WAN, with a lighter device at each site.

What usually stays local is segmentation between internal networks and anything that must work without the internet. Jimber covers the three movable jobs on one European platform, with firewall-as-a-service, ZTNA, a secure web gateway and SD-WAN, and data handled in the EU. Fortinet's own cloud route is FortiSASE; what FortiGate customers pay for FortiSASE sets out that comparison.

The case for staying with FortiGate

A Fortinet administrator will make three fair points.

"Cloud security does not help my internal traffic." Correct. A 120G routes and inspects traffic between internal segments at tens of gigabits with microseconds of latency and no data charges. If your site has heavy east-west traffic, keep a local firewall for it. That is an argument for a local enforcement point, not necessarily for routing remote users and internet traffic through it.

"The Security Fabric ties it all together." FortiGate, FortiSwitch and FortiAP under FortiLink, managed together, is efficient, and a second platform means a second console. The question is whether that integration is worth a hardware refresh every five years for the jobs that no longer depend on the building.

"Hardware is a known cost." A 120G pair amortised over five years, with throughput limited only by the ASIC, is predictable. Per-user subscriptions grow with headcount. For a stable, office-based workforce that can tip the balance to hardware. For a hybrid workforce, include the remote-access rebuild, the token repurchase and the next refresh in 2031 in the same comparison.

Conclusion

The FortiGate 100F has support until April 2031, but the decisions arrive earlier: SSL VPN tunnel mode is gone in FortiOS 7.6.3, generation 1 units struggle under modern inspection, and contracts can only be extended until April 2030. Check which generation you run, line up your contract dates, and decide per site which of the 100F's jobs need a box at all.

If remote access and web security are the main reasons your 100F exists, Try Free with one site or user group. Or book a demo and we will go through your FortiGate estate together.

Frequently asked questions

What is the FortiGate 100F end-of-life date?

Fortinet announced end of life on 16 January 2026. End of order was 16 April 2026, the last service extension date is 16 April 2030 and end of support is 16 April 2031. The FortiGate 101F has the same dates.

Does my FortiGate 100F stop working after end of order?

No. End of order only stops new hardware sales. With an active contract, the 100F keeps receiving support, firmware and security updates until 16 April 2031.

What replaces the FortiGate 100F?

The FortiGate 120G, or the 121G with internal storage. It roughly doubles firewall and NGFW throughput and nearly triples threat protection, but has 18 copper ports instead of 22 and no dedicated DMZ port.

Which FortiOS versions does the 100F support?

The 100F and 101F run current releases, including FortiOS 7.6 and 8.0. FortiOS 7.6.3 and later no longer support SSL VPN tunnel mode, so remote access has to move to IPsec or another solution before upgrading.

How do I know whether my 100F is generation 1 or 2?

Run get hardware status on the CLI. Generation 1 units report about 3,614 MB of RAM and hardware revision Rev1; generation 2 units report about 7,587 MB and Rev2. Generation 1 units have less headroom for SSL inspection and proxy features.

Can I mix a 100F and a 120G in one HA cluster?

No. Fortinet requires all cluster members to be the same model with the same firmware. Replacing an HA pair means staging a new 120G cluster and cutting over in one maintenance window.

Can I restore a 100F configuration onto a 120G?

Not directly. The interfaces differ, including the missing DMZ port and the shared ports. Translate the configuration with FortiConverter or remap the interfaces before restoring.

Can existing licences move from a 100F to a 120G?

Through Fortinet's trade-up programme, remaining support and security services can move to a model in the trade-up matrix. FortiToken Mobile licences shipped on or after 4 August 2025 cannot be transferred except on RMA.

What is the last date to renew support on a 100F?

16 April 2030, the last service extension date. After that Fortinet accepts no renewals, and coverage simply runs out at the latest on 16 April 2031.