FortiGate 50G, 70G or 90G? Choosing a firewall by office size

If you are putting a real firewall in front of a Hong Kong office for the first time, the model number is the least useful thing to start with. What decides the box is how many people sit behind it. Here is how we match the three FortiGate models we quote most often to the office in front of us.

The short version

• FortiGate 50G — a new or small office of up to about twenty people.
• FortiGate 70G — roughly forty to sixty people, on an ordinary sub-gigabit circuit.
• FortiGate 90G — up to about a hundred people, or anyone with fibre uplinks and heavy remote access.

Why headcount, not throughput

The published throughput figures are measured with security inspection switched off. Once you enable the intrusion prevention and web filtering you are actually buying the box for, throughput falls — often to a tenth of the headline number. So the number on the datasheet tells you very little about how the firewall behaves on a Monday morning when the whole office logs in at once.

People are a better proxy. Each user brings email, cloud applications, video calls and a phone on the Wi-Fi, and the inspection load scales with them. Once you know the headcount, the throughput question mostly answers itself.

When to jump a size up

Two things push an office one model higher than its headcount alone would suggest.

The first is a fibre circuit or a fibre link to another floor. If your internet line is above 1 Gbps, or you need to run fibre between sites, you need the SFP+ ports that the 50G and 70G offer only one of and the 90G is built around. This is the single most common reason a business is forced to upgrade earlier than expected.

The second is remote access. Five people on VPN is nothing; fifty connecting every morning at nine is a real load on memory and CPU. If a large share of your team works remotely, size up.

What we usually recommend

For a brand-new office of around twenty people, the 50G is the honest answer, and it is the model we quote most for a first fit-out. Between thirty and a hundred people, or anywhere with fibre uplinks or significant remote access, the 90G is the model that will not need replacing in two years. The 70G sits between them for the office that is clearly past small but not yet near a hundred.

Whichever you choose, budget for the security subscriptions, not just the hardware — a firewall running without an active IPS and web filtering licence is an expensive router. If you would rather not work it out from a spec sheet, send us the headcount and we will tell you which one we would install.