FortiGate 40F End of Life: Why the 50G Is Not Automatically the Answer

The base FortiGate 40F is not end of life. Fortinet has not announced an End of Order date for the desktop model, and it is still in active production. Two variants have moved, though: the cellular 40F-3G4G passed End of Order on 13 August 2025 with support running to 13 August 2030, and the FortiWiFi 40F passed End of Order on 1 May 2026 with support to 1 May 2031.

So the dates are not your problem. The successor choice is. Your distributor will quote the FortiGate 50G, because it sits at the same price point and the naming suggests continuity. The 50G has 2GB of RAM, exactly like the 40F, and no SSL-VPN server at all. Nobody has published the comparison that actually decides this purchase, so that is what the middle of this article is.

What each Fortinet milestone stops

Fortinet runs four milestones and the gaps between them are long, which is why reseller pressure and manufacturer reality often disagree by years.

• End-of-Life Announcement. Advance notice. Nothing changes.
• End of Order, also called End of Sale. Last date to buy through authorised channels. Manufacturing stops. Everything you own keeps working with full support.
• Last Service Extension Date. Falls 48 months after End of Order, twelve months before the end. This is the final opportunity to extend or renew a FortiCare or FortiGuard contract. Miss it and you cannot buy support for that unit again, even though support has not technically ended.
• End of Support, also called End of Service Life. Sixty months after End of Order. Technical assistance, firmware security patches, dynamic threat feeds and hardware replacement all terminate.

The one that catches people is the Last Service Extension Date, because it is silent. Nothing fails on that day; you simply lose the ability to keep the unit covered for its final year.

FortiGate 40F family lifecycle

Last verified: September 2026.

Source: Fortinet’s Product Life Cycle portal, which requires a support login. Verify there before acting on any date. Two notes on reading this table. The base 40F rows say “not published” rather than a projected date: because no End of Order has been announced, the 48-month and 60-month milestones have nothing to count from, and any specific year you see quoted elsewhere is arithmetic rather than a Fortinet commitment. And there is no FortiGate 40F-POE. It was never released as a SKU, so if a reseller is quoting you a lifecycle date for one, something is wrong with the quote.

This is also where most of the confusion in the market comes from. Lifecycle aggregators scrape these tables and routinely apply the cellular or wireless variant dates to the whole family, which is why AI summaries for this query sometimes state that the 40F reached End of Sale in 2025 or 2026. It did not. The base desktop unit is still orderable.

The real clock is FortiOS, not the hardware

Hardware support running to roughly 2031 sounds comfortable until you look at what the software has already removed from 2GB appliances.

Read that top row again if you are still on 7.2. End of Support is 30 September 2026, which is seventeen days from publication. After that the branch receives no further security fixes. We covered the version lifecycle and the upgrade path per hardware generation in the FortiOS 7.2 end-of-support guide, and the hardware dates for every other model in the FortiGate hardware timeline.

50G or 70G: the comparison your distributor will not send you

Each figure comes from Fortinet’s published datasheets under its own test methodology, and the methodologies are not interchangeable. Firewall throughput is UDP at fixed frame sizes under RFC 2544. IPS throughput uses an Enterprise Traffic Mix under continuous inline attack traffic. NGFW runs firewall, IPS and Application Control in parallel. Threat Protection adds Advanced Malware Protection and full session logging. SSL inspection is decrypted HTTPS with IPS applied to the payload. Comparing a 5 Gbps firewall number against a 600 Mbps Threat Protection number is the single most common sizing error in this class of appliance, and it is how a 40F ends up on a 1 Gbps circuit.

The row that decides the purchase is memory. The 50G moves to the SP5 processor and roughly doubles inspected throughput on paper, and it keeps 2GB of RAM. That is the same constraint that produced conserve mode on the 40F, on the same firmware branches that will be current for the next five years.

The sizing rule

Stated as a rule: the 50G is a spoke-site appliance for under ten people with inspection handled somewhere else. Anything above roughly fifteen users, a gigabit circuit, local deep inspection or a second WAN link needs the 70G.

Three mechanics sit underneath that. First, decryption and circuit saturation. The 40F does 600 Mbps Threat Protection and 310 Mbps SSL inspection, so on a symmetrical gigabit fibre line it throttles inspected traffic by roughly 40% to 70%. The 50G looks much better on paper, but with mixed payload sizes and bidirectional IPsec running alongside deep inspection it approaches its compute ceiling somewhere around 600 to 700 Mbps of real traffic. The 70G handles a full gigabit with deep packet inspection on.

Second, the memory arithmetic. On a 2GB unit under FortiOS 7.4, 7.6 or 8.0, the core daemons — wad, ipsengine, miglogd — take 1.3GB to 1.5GB just holding routing and session tables. Automated FortiGuard signature and Internet Service Database updates spike memory by 10% to 20%. On an appliance already sitting at a 68% to 72% baseline, that update breaches the default 88% conserve threshold and the unit enters conserve mode, which drops new connections, stops session logging or passes traffic uninspected depending on your fail mode. The usual workaround is disabling IPS acceleration from the CLI with set cp-accel-mode none, which trades inspection efficiency for stability. The 70G’s 4GB sits at a 35% to 42% baseline and has room for the update.

Third, ports and user density. A modern knowledge worker running SaaS, a browser and unified communications holds roughly 80 to 120 concurrent TCP connections. Fifteen to twenty users is 4,000 to 6,000 active flows, which the 50G routes fine at Layer 4 and struggles to inspect. And the 50G’s five ports are one WAN, one FortiLink and three LAN. A dual-homed branch has to convert a LAN port into a second WAN, leaving two ports for everything local. The 70G gives you two dedicated WAN ports, two FortiLink and six internal, which is enough for SD-WAN across two providers plus a server and an access point without adding a switch.

What it costs, and what staying costs

European reseller listings, excluding VAT, recorded in early 2026. These are reseller prices, not Fortinet list prices, and they move.

Three-year positions per site: keeping the 40F on annual UTP renewals is roughly €1,140 to €1,260. A 50G with a three-year bundle is about €1,950. A 70G with a three-year bundle is about €2,420.

The number worth putting in front of whoever signs the purchase order is the delta. Over three years the 70G costs about €470 more per branch than the 50G, which is roughly €13 per site per month. Across forty sites that is €78,000 versus €96,800. For that difference you get twice the RAM, ten ports instead of five, native dual WAN, and you stop inheriting the constraint you are replacing. It is unusual for a sizing argument to be this cheap to win.

What the migration actually involves

A 40F configuration will not restore onto a 50G or 70G through the interface. The port naming differs across all three generations.

Manual migration means editing the model identifier in the configuration header from #build: 40F to the target model and doing a global find-and-replace on interface names. Fortinet’s FortiConverter service does the remapping and strips deprecated syntax for roughly €51.80 per device translation, which is cheap against the engineer hours if you have more than a handful of sites.

Two things break quietly. Firmware schema: early SP5 hardware shipped on hardware-specific FortiOS builds rather than the mainline branch, so restoring a config from mainline 7.4.7 onto a 70G running an early 7.2.11 build fails on schema mismatch. Align both units on a mature universal release — 7.4.9 or later, or 7.6.4 or later — before importing anything. And remote access: if your 40F config contains config vpn ssl web or config vpn ssl settings, the G-series CLI parser flags those commands as invalid and discards them. Your remote access configuration disappears without an error anyone reads. Move users to IPsec via FortiClient or to ZTNA before you migrate the hardware, not after. The WireGuard and ZTNA options for FortiGate estates are covered in this comparison.

Finally, licensing is bound to the serial number. Buying replacement hardware does not move an active FortiCare or FortiGuard balance; that requires an authorised trade-in through the Fortinet TradeUp Programme.

Does the site need a box at all

Field reports put 40F units in three roles, and only one of them clearly justifies a next-generation firewall.

As an IPsec spoke for three to ten people, with local breakout disabled and all inspection handled at a central cluster, the appliance is doing routing and crypto. Paying €600 or more a year for local FortiGuard signatures that never inspect anything is hard to defend; a reliable edge router does this job.

As a retail or kiosk gateway for one to five people using only cloud applications, the maths is worse. Hardware and subscription run past €1,500 per site, plus firmware cycles and RMA handling, to protect traffic that is going straight to SaaS. A commodity router for NAT and routing, with endpoints running a lightweight agent to an EU-based inspection point, removes the appliance from the risk register entirely.

As a complex branch with fifteen to fifty users, local servers, VLANs and internal switching, the answer is genuinely the 70G. Cloud inspection does not do local Layer 2 and 3 segmentation, DHCP or physical port switching, and pretending otherwise creates a worse design than the one you started with.

The compliance angle sharpens the first two cases. NIS2 and DORA expect inspection across encrypted web traffic to be demonstrable, and a 2GB appliance that enters conserve mode during a signature update cannot demonstrate that reliably. Running that inspection on an EU-hosted platform and leaving a plain router on site removes a per-branch patching liability from the audit scope. That is the honest architectural question here, and for sites in the first two profiles it deserves answering before the hardware budget is signed. Jimber runs exactly that split: inspection and application access in one EU-sovereign platform, the branch hardware reduced to transport.

The case for buying the cheapest successor

An IT manager with forty small sites has a real argument for ordering forty 50Gs and moving on, and it is not laziness.

Fleet uniformity has genuine operational value: one model, one firmware baseline, one spares shelf, one runbook, one line in the budget. Per-site sizing conversations across forty locations cost engineer time that nobody has, and the €78,000 outlay is already a difficult ask. Most of those sites genuinely are small. And the 50G is a real improvement on the 40F — SP5 silicon, roughly double the inspected throughput, better session handling.

The counter is that uniformity is exactly what makes the memory decision expensive. Standardising on a 2GB platform means standardising on the constraint across all forty sites for the next five years, and the sites that outgrow it will not announce themselves — they will show up as intermittent conserve mode, dropped sessions and an engineer disabling IPS acceleration to keep a branch stable. At €13 per site per month, the 70G buys uniformity at a specification that does not need managing around. If the budget genuinely will not stretch, the defensible version is a split by profile rather than a split by site: 50Gs where inspection is backhauled, 70Gs where it is local. What does not work is choosing the 50G because it is what the quote said.

Where to start

Check two things this week. Whether any of your 40F units are cellular or wireless variants, because those have live End of Order dates and a Last Service Extension deadline in 2029 or 2030. And what FortiOS branch each unit runs, because 7.2 stops receiving security fixes on 30 September 2026.

Then, before you accept a 50G quote, count the users and the circuit speed at each site. Under ten people with inspection elsewhere, the 50G is the right box. Fifteen or more, a gigabit line, or local deep inspection, and it is not. For the sites where the honest answer is that nothing local needs inspecting, book a demo and we will walk through what moves off the box, or get in touch with your site list. The wider cost picture for that kind of move is in SASE migration hidden costs, and the FortiSASE comparison in what FortiGate customers actually pay.

Frequently asked questions

Is the FortiGate 40F end of life?

The base desktop 40F is not. Fortinet has announced no End of Order date and it remains in active production. The cellular 40F-3G4G reached End of Order on 13 August 2025 and the FortiWiFi 40F on 1 May 2026. Lifecycle aggregators frequently apply those variant dates to the whole family.

What is the direct replacement for a FortiGate 40F?

Fortinet and distributors position the FortiGate 50G as the price-point successor. Technically it is only suitable for sites under ten users with inspection handled elsewhere, because it carries the same 2GB of RAM. For fifteen or more users, gigabit circuits or local deep inspection, the 70G is the correct replacement.

Why are features missing on my FortiGate 40F?

The 40F has 2GB of RAM, and modern FortiOS overhead exceeds what that allows. From FortiOS 7.4.4 Fortinet disabled proxy-based inspection on 2GB models, and FortiOS 7.6 removes the SSL-VPN server daemon entirely in both tunnel and web mode. These are deliberate removals to prevent memory exhaustion.

Does the FortiGate 50G support SSL-VPN?

No. The 50G launched without an SSL-VPN server and never had one. The 70G had SSL-VPN removed from FortiOS 7.4.8 onwards. Remote users on a G-series branch appliance need IPsec via FortiClient or a ZTNA approach instead.

What is the RAM difference between the 50G and 70G?

The 50G has 2GB, the 70G has 4GB. On 2GB, core daemons consume 1.3GB to 1.5GB at rest and FortiGuard signature updates spike usage by 10% to 20%, which breaches the 88% conserve threshold. The 70G sits at a 35% to 42% baseline with headroom for updates.

Can I restore a 40F configuration onto a 70G?

Not directly. The 40F uses port1, port2 and internal1 to internal3; the 70G uses wan1, wan2, fortilink1, fortilink2 and internal1 to internal6. You must edit the model identifier in the configuration header and remap interfaces manually, or use FortiConverter, which costs roughly €51.80 per device translation.

What is the Threat Protection throughput of the FortiGate 70G?

1.3 Gbps, measured with firewall, IPS, Application Control and Advanced Malware Protection active and session logging enabled. It also delivers 1.4 Gbps of SSL inspection throughput and tracks 1.4 million concurrent TCP sessions. The 50G reaches 1.1 Gbps Threat Protection and 1.3 Gbps SSL inspection.

Can a FortiGate 40F handle a 1 Gbps internet connection?

Not with inspection enabled. It delivers 600 Mbps of Threat Protection and 310 Mbps of SSL inspection, so running deep inspection on a symmetrical gigabit circuit throttles usable bandwidth by roughly 40% to 70%. It routes a gigabit fine; it cannot inspect one.

Do my FortiCare and FortiGuard licences transfer to the new appliance?

Not automatically. Subscriptions are bound to the physical device serial number, and buying replacement hardware does not move a remaining balance. Transferring it requires an authorised trade-in processed through the Fortinet TradeUp Programme with a partner.

Should I wait before deploying new G-series hardware?

Practitioners commonly suggest six to twelve months after a platform launch. Early SP5 appliances shipped on hardware-specific FortiOS builds rather than the mainline branch, which caused configuration schema mismatches and FortiManager synchronisation problems in mixed F-series and G-series estates.