FortiGate G-Series Explained: Which Model Replaces Your F
If you run a FortiGate 40F, 60F, 70F, 80F or 100F, the G-series is where Fortinet sends you next. The short version: a 60F or 70F becomes a 70G, an 80F becomes a 90G, a 100F becomes a 120G, and a small 40F site can drop to a 50G. On paper, every step up roughly doubles inspection throughput.
One thing does not improve. The 30G and 50G never supported SSL VPN, the 70G lost SSL VPN from FortiOS 7.4.8, the 90G does not support SSL VPN, and from FortiOS 7.6.3 SSL VPN tunnel mode is gone on every FortiGate. A G-series refresh buys throughput. Remote access still has to be rebuilt. This page covers the mapping, the specification delta per pair, the remote-access consequence and how long a G model will be supported.
The FortiGate G-series lineup
Fortinet launched the G-series in stages. The 90G came first in 2023 as the first model with Fortinet's fifth-generation SP5 security processor. The 30G, 50G and 70G followed on 6 February 2025. The 120G has no separate launch announcement; it appears in FortiOS release notes from version 7.0.12 onward.
| G model | Announced | Processor | Succeeds | Storage variant |
|---|---|---|---|---|
| FortiGate 30G / 31G | 6 February 2025 | SoC4 | 30E | 31G: 30 GB SSD |
| FortiGate 50G / 51G | 6 February 2025 | SP5 | 50E; small 40F sites | 51G: 64 GB SSD |
| FortiGate 70G / 71G | 6 February 2025 | SP5 | 60F, 70F, 60E, 70E | 71G: 64 GB SSD |
| FortiGate 90G / 91G | 2023 | SP5 | 80F, 80E, 90E | 91G: 120 GB SSD |
| FortiGate 120G / 121G | no separate announcement | SP5 | 100F, 101F | 121G: 480 GB SSD |
Source: Fortinet Product Matrix (October 2026), Fortinet datasheets and press releases.
Two details save a lot of searching. First, there is no standard FortiGate 60G and no 80G. The only 60G Fortinet sells is the FortiGate Rugged 60G for industrial sites. Second, the 30G runs on the older SoC4 processor, not SP5, even though several reseller pages describe the whole desktop range as SP5.
Which G model replaces my F model, and what do I lose?
Fortinet's own launch material does not say which G model replaces which F model. Resellers and the Fortinet lifecycle records point the same way: 70G for the 60F and 70F, 90G for the 80F, 120G for the 100F. The 40F still sells and has no direct G-series twin; the 50G and 70G cover the two ends of what a 40F does. The pairs below use Fortinet's own figures and mark where the G model is weaker or only equal.
FortiGate 40F: 50G or 70G
The 50G is not a full upgrade of the 40F. The 50G is much faster at inspection but keeps the same policy, tunnel, FortiAP and FortiSwitch limits, and supports half the virtual domains. The 70G is the real step up.
| Specification | 40F | 50G | 70G |
|---|---|---|---|
| Threat protection | 600 Mbps | 1.1 Gbps | 1.3 Gbps |
| SSL inspection | 310 Mbps | 1.3 Gbps | 1.4 Gbps |
| IPsec VPN | 4.4 Gbps | 4.5 Gbps | 7.1 Gbps |
| Concurrent sessions | 700,000 | 720,000 | 1.4 million |
| Client-to-gateway IPsec tunnels | 250 | 250 (equal) | 500 |
| Max FortiAPs (total / tunnel) | 16 / 8 | 16 / 8 (equal) | 96 / 48 |
| Virtual domains (max) | 10 | 5 (lower) | 10 |
| Interfaces | 5x GE RJ45 | 5x GE RJ45 | 10x GE RJ45 |
Source: Fortinet Product Matrix (October 2026).
The FortiGate 40F article has the sizing rule in detail: the 50G fits a site with around ten users and no local deep inspection, the 70G fits everything above that.
FortiGate 60F and 70F: the 70G
For a 60F, the 70G is a like-for-like box with the same ten GE ports and about twice the inspection capacity. Against a 70F the gain is smaller, and the 70G storage variant has half the SSD.
| Specification | 60F | 70F | 70G |
|---|---|---|---|
| Threat protection | 700 Mbps | 800 Mbps | 1.3 Gbps |
| SSL inspection | 630 Mbps | 700 Mbps | 1.4 Gbps |
| Firewall (64-byte UDP) | 6 Gbps | 6 Gbps | 10 Gbps |
| Concurrent sessions | 700,000 | 1.5 million | 1.4 million (lower than 70F) |
| New sessions per second | 35,000 | 35,000 | 100,000 |
| Client-to-gateway IPsec tunnels | 500 | 500 | 500 (equal) |
| Storage variant | 128 GB (61F) | 128 GB (71F) | 64 GB (71G, lower) |
Source: Fortinet Product Matrix (October 2026).
The 70F reached end of order on 17 May 2026. The 60F still has no end-of-order date; the FortiGate 60F article explains what that means for its firmware ceiling.
FortiGate 80F: the 90G
The 90G is the biggest jump in the range. The 90G nearly triples firewall throughput and almost quadruples IPsec VPN throughput over the 80F, and adds two 10GE WAN ports. The 90G also draws more power, which matters only in a cramped or passively cooled cabinet.
| Specification | 80F | 90G |
|---|---|---|
| Threat protection | 900 Mbps | 2.2 Gbps |
| SSL inspection | 715 Mbps | 2.6 Gbps |
| Firewall (1518-byte UDP) | 10 Gbps | 28 Gbps |
| IPsec VPN | 6.5 Gbps | 25 Gbps |
| Client-to-gateway IPsec tunnels | 2,500 | 2,500 (equal) |
| WAN interfaces | 2x shared RJ45/SFP | 2x shared 10GE RJ45/SFP+ |
| Power, average | 12.69 W | 19.9 W (higher) |
Source: Fortinet Product Matrix (October 2026), FortiGate 80F and 90G datasheets.
FortiGate 100F: the 120G, or the 90G for smaller sites
The 100F and 101F reached end of order on 16 April 2026, with support until 16 April 2031. Resellers list the 120G as the replacement, and the 120G is the closest G model to a 100F in form factor and ports. The 90G matches the 100F on raw throughput at a lower price, but not on tunnels, SFP ports, dual power supplies or rack mounting.
| Specification | 100F | 120G | 90G |
|---|---|---|---|
| Threat protection | 1 Gbps | 2.8 Gbps | 2.2 Gbps |
| IPsec VPN | 11.5 Gbps | 35 Gbps | 25 Gbps |
| Gateway-to-gateway IPsec tunnels | 2,500 | 2,000 (lower) | 200 (lower) |
| Client-to-gateway IPsec tunnels | 16,000 | 16,000 (equal) | 2,500 (lower) |
| Fibre interfaces | 4x GE SFP, 2x 10GE SFP+ | 8x GE SFP, 4x 10GE SFP+ | 2x shared 10GE SFP+ |
| Power supply | Dual | Dual AC | Single |
| Form factor | 1 RU | 1 RU | Desktop |
Source: Fortinet Product Matrix (October 2026), FortiGate 100F and 120G datasheets.
A 100F that terminates many site-to-site tunnels or dial-up users belongs on a 120G. The FortiGate 100F article covers the dates, the cost of staying and the HA migration.
Three checks before you pick a G model
The tables answer "which model is faster". Three questions answer "which model fits this site", and the answers often matter more than throughput.
- How many tunnels does the site terminate? Count site-to-site tunnels and dial-up users at peak. The 50G stops at 250 dial-up tunnels, the 70G at 500, the 90G at 2,500 and the 120G at 16,000. A site that is close to a limit today will pass that limit within the life of the new box.
- Which ports does the site need? The 70G is copper only, and so is the 50G except for its SFP variant. Fibre uplinks or a 10GE core switch point to the 90G or the 120G, and a rack with dual power feeds points to the 120G.
- Where does inspection happen? If traffic to the internet and to cloud applications is inspected on site, size for threat protection throughput with SSL inspection switched on. If that traffic already goes through a cloud service, the branch box only handles local traffic and can be a size smaller.
The third question links directly to remote access, which is where the G-series changes the most.
SSL VPN on the G-series: what changes for remote access
None of the desktop G models supports SSL VPN on current firmware. The 30G and 50G never supported SSL VPN, the 70G lost SSL VPN from FortiOS 7.4.8, and the 90G does not support SSL VPN. On the 120G and larger, tunnel mode is gone from FortiOS 7.6.3 and only web mode remains, renamed Agentless VPN.
| Model | SSL VPN status |
|---|---|
| 30G, 50G | Never supported |
| 40F, 60F | Up to FortiOS 7.4; removed from 7.6.0 |
| 70G | FortiOS 7.2 only; removed from 7.4.8 |
| 70F, 80F, 100F | Up to FortiOS 7.6.2; tunnel mode removed from 7.6.3 |
| 90G | Not supported |
| 120G and larger | Tunnel mode removed from 7.6.3; web mode remains as Agentless VPN |
Source: Fortinet Community technical tip "SSL VPN support on FortiGate models", FortiOS 7.6 release notes.
Fortinet's own advice for the affected models is to move remote users to IPsec dial-up VPN. That is a real migration: a new client configuration on every laptop, new authentication settings and a helpdesk wave. The SSL VPN timeline per vendor shows that Fortinet is not alone, and the Fortinet SSL VPN article covers the 7.6.3 change in detail.
If the reason you are looking at a G model is an SSL VPN that has to go, a new box does not solve the problem. Replacing the VPN itself is a separate decision, and the moment to make that decision is before you size the new firewall.
How long will a G model be supported?
No FortiGate G model has an end-of-order or end-of-support date. Under Fortinet's product lifecycle policy, hardware support ends 60 months after end of order, and the last date to extend a support contract falls 12 months before end of support. Fortinet usually announces an end of order one quarter in advance.
In practice, a G model bought today has at least five years of support after an end-of-order date that does not exist yet. Recent F-series end-of-order dates show the rhythm: the 200F on 1 March 2026, the 100F on 16 April 2026 and the 70F on 17 May 2026. The FortiGate end-of-life timeline keeps every model's dates in one table.
Before you buy: known G-series firmware issues
The G-series is new hardware, and early firmware has had problems. Fortinet documents three issues for the 70G in its own technical tips:
- FortiOS 7.4.8 for the 70G was withdrawn because of a BIOS certificate failure on specific serial numbers. The fix is FortiOS 7.4.9 or later.
- The 70G and 71G can reboot unexpectedly on FortiOS 7.6.5 and later when NTurbo-accelerated flow inspection is active; Fortinet says the 50G appears to have a similar issue. The fix is in FortiOS 7.4.13, 7.6.7 and 8.0.1.
- A 70G with a newer BIOS can hang at boot after a downgrade to FortiOS 7.2, with no workaround reported.
None of these issues is a reason to avoid the G-series. All three are reasons to pin a tested firmware version before a rollout and to read the FortiOS 7.4 lifecycle before choosing a branch.
What a G model costs
Fortinet does not publish list prices. These are reseller listings for the one-year bundle with FortiCare Premium and FortiGuard Unified Threat Protection, as shown on price comparison sites on 2 November 2026.
| Bundle (hardware + 1 year UTP) | Listed price incl. VAT | Where |
|---|---|---|
| FortiGate 70G (FG-70G-BDL-950-12) | €2,082.50 | Reseller via idealo.de |
| FortiGate 70G (FG-70G-BDL-950-12) | €1,374.51 | Reseller via trovaprezzi.it (October 2026) |
| FortiGate 120G (FG-120G-BDL-950-12) | €4,760.00 | Reseller via idealo.de |
Source: idealo.de and trovaprezzi.it listings, 2 November 2026. Reseller prices vary widely; a Fortinet partner quote is the only reliable figure.
The spread between two listings for the same 70G bundle shows why a quote matters. The real cost also includes the renewal from year two, which is usually the larger number over five years.
When an F-to-G refresh is the wrong answer
A like-for-like G refresh is the right call when the box does local work: routing between VLANs, inspecting traffic to a local server room, terminating site-to-site tunnels to other offices. The G models do that work well and for less power per gigabit.
A refresh is the wrong answer when the real problem is remote access. Every G model gives up SSL VPN tunnel mode, so a refresh leaves you with the same remote-access migration you had before, plus new hardware. That is the moment to separate the two jobs. Remote users and branch internet traffic can move to ZTNA and a cloud-delivered secure web gateway, and the branch firewall can be sized for local traffic only, or kept on the F model until end of support.
For a European mid-market organisation, the Jimber SASE platform does that in one console, with agentless access and data handled in the EU, at a predictable cost instead of a hardware cycle. Try Free and test remote access alongside your current FortiGate before you size the new box.
The case for simply buying the G model
An experienced FortiGate partner would push back on this, and some of the arguments are fair.
"IPsec dial-up with FortiClient works fine on the firewall you already own." True for many teams. But the move from SSL VPN to IPsec is still a client and authentication migration, and IPsec keeps the network-level access model that SSL VPN had. You do the work once and end up where you started.
"A G refresh is the cheapest security upgrade you can buy, on a console your team knows." Also true, if the bottleneck is inspection throughput on site. If most users work remotely or in the cloud, the throughput sits in the wrong place.
"A G model has no end-of-order date and five years of support after that." Correct, and a strong argument for the box that stays. The argument does not extend to remote access, which Fortinet has already moved away from on every G model.
Conclusion
The G-series is a clear step up in throughput: 70G for a 60F or 70F, 90G for an 80F, 120G for a 100F, and a 50G only for the smallest 40F sites. Check the weaker lines in each pair, pin a tested firmware version, and do not expect a G model to keep SSL VPN.
Decide on remote access first, then size the firewall. If remote access moves to ZTNA, the new box can be smaller, or the old one can run to the end of its support. Try Free to see how that works in practice, or book a demo to walk through your own sites.
Frequently asked questions
Which FortiGate G model replaces the 60F?
The FortiGate 70G. The 70G has the same ten GE ports as the 60F and roughly doubles threat protection (1.3 Gbps against 700 Mbps) and SSL inspection (1.4 Gbps against 630 Mbps). The 70G does not support SSL VPN on FortiOS 7.4.8 or later, so remote users need IPsec or another remote-access method.
Is there a FortiGate 60G?
No. Fortinet has not released a standard FortiGate 60G. The only 60G is the FortiGate Rugged 60G for industrial environments. For an office 60F, the G-series successor is the 70G, announced on 6 February 2025 together with the 30G and 50G.
When was the FortiGate 70G released?
Fortinet announced the FortiGate 70G on 6 February 2025, together with the 30G and 50G. The 90G came earlier, in 2023, as the first FortiGate with the SP5 processor. The 70G first shipped on a special FortiOS 7.2 build before mainstream FortiOS 7.4 and 7.6 support.
Does the FortiGate 70G support SSL VPN?
Only on FortiOS 7.2. Fortinet removed SSL VPN from the 70G starting with FortiOS 7.4.8, and from FortiOS 7.6.3 SSL VPN tunnel mode is gone on every FortiGate. Fortinet recommends IPsec dial-up VPN for remote users on the affected models.
Is the FortiGate 50G a good replacement for the 40F?
Only for small sites. The 50G is much faster at inspection than the 40F, but keeps the same limits for firewall policies, dial-up tunnels, FortiAPs and FortiSwitches, and supports five virtual domains instead of ten. For sites with more than about ten users or local deep inspection, the 70G is the better fit.
90G or 120G for a 100F site?
The 120G when the 100F terminates many tunnels, uses fibre ports, needs dual power supplies or sits in a rack: the 120G keeps 16,000 dial-up tunnels and adds SFP and 10GE ports. The desktop 90G is cheaper and matches the 100F on throughput, but supports only 2,500 dial-up tunnels.
When does the FortiGate G-series reach end of life?
No G model has an end-of-order or end-of-support date. Under Fortinet's lifecycle policy, hardware support ends 60 months after end of order, and Fortinet usually announces an end of order one quarter in advance. A G model bought today therefore has at least five years of support after any future end-of-order date.
Which processor does the G-series use?
The 50G, 70G, 90G, 120G and 200G use Fortinet's fifth-generation SP5 security processor. The 30G is the exception: the 30G datasheet lists the older SoC4. The 90G was the first FortiGate with SP5.
Are there known firmware problems on the 70G?
Yes, three are documented by Fortinet. FortiOS 7.4.8 was withdrawn for the 70G because of a BIOS certificate issue; unexpected reboots occur on FortiOS 7.6.5 and later with NTurbo, fixed in 7.4.13, 7.6.7 and 8.0.1; and a newer BIOS can hang after a downgrade to 7.2. Pin a tested version before a rollout.