Fortinet FortiGate 40-90 · 100-300 Maintenance
side by side.

FortiGate 40-90 Series · branch & small-office

FG-40F · FG-60F · FG-70F · FG-80F · FG-90G (with integrated WiFi and PoE+ options)

FortiGate 100-300 Series · mid-market & larger branches

FG-100F · FG-101F · FG-200F · FG-201F · FG-300E · FG-301E (higher throughput, redundant PSUs from FG-200F)

SD-WAN hardware coverage

WAN ports (multi-WAN configuration) · LTE modules · console and management ports · SD-WAN sensors

Hardware components · what we replace

Power supplies · fans · eMMC/SSD modules · mainboards · front panel LEDs · bezels

PoE+ ports · direct FortiAP/FortiSwitch connection

PoE+ port modules for integrated branch topologies with FortiAP and FortiSwitch without extra switch

HA-pair and cluster · branch/mid-market configurations

Active/passive HA pair · active/active HA pair · FGCP cluster · HA-sync cabling

Lifecycle status of FortiGate 40-90 and 100-300 series

Fortinet FortiGate is one of <strong>dominant platforms</strong> in DACH SD-WAN market — typically deployed in multi-site configurations with hundreds of branch sites under central FortiManager control. Fleets with 50-500+ branch firewalls plus 10-30 mid-market firewalls standard in mid-sized and enterprise configurations, especially companies with historically grown branch structure (retail, banking, insurance, logistics). FortiCare Premium Support for the hardware layer (premium without FortiGuard bundle) rises noticeably from FG-60F through FG-200F to FG-301E. TPM reduces this 30-60 percent below. <strong>Bulk pricing lever:</strong> for an SD-WAN fleet with 100 FG-60F plus 20 FG-200F plus 5 FG-301E, annual maintenance with TechCare is roughly 55% below the Fortinet price — TPM migration pays back in first quarter. <strong>HA-pair pricing lever:</strong> active/passive HA branch standard in DACH — passive HA node need not be covered at same SLA level as active. Active 24×7×4 + passive 5×9 NBD saves another 20-30 percent vs. same SLA tier for both nodes. With 100 HA pairs, this is an additional noticeable annual pricing lever.

We service Fortinet FortiGate branch and mid-market hardware with <strong>OEM original parts</strong> and deep refurbishing pools across multiple FortiOS hardware generations. Current F and G generations (FG-40F, FG-60F, FG-90G, FG-100F, FG-200F, FG-301E) completely in active pool. Older E generations (FG-300E, FG-301E) and D generations (FG-100D, FG-200D, FG-300D — typically deployed in DACH fleets 2016-2020) structured available in our refurbishing pool. For FG-60F with integrated WiFi (FG-60F-WiFi-6) we consider wireless hardware specifics. <strong>SD-WAN hardware specifics:</strong> multi-WAN configurations with two or three separate WAN connections (typically internet plus MPLS plus LTE as backup) require correspondingly more WAN ports and stable multi-path hardware performance — we also service LTE module hardware on models with integrated LTE (FG-60F-3G4G, FG-90G-LTE). <strong>Hardware vs software separation honestly communicated:</strong> we replace hardware components — all FortiGuard subscriptions, FortiCloud services and FortiOS updates continue unchanged via Fortinet. With hardware defects you have two service paths in parallel: Fortinet ticket for FortiGuard/FortiOS issues, TechCare ticket for hardware. Split is transparent — a FortiGate solution without active FortiGuard subscription would be just a dumb packet filter and accordingly worthless.

The full OEM-vs-TPM matrix (spare parts, SLA tiers, language, sub-outsourcing, compliance docs, reporting) is the same for every Fortinet line — see the Fortinet battle card.

BAIT/MaRisk documentation package, DORA Art. 28 contract template, ISO 27001 and GDPR-compliant media handling apply identically to every Fortinet line — details on the Fortinet battle card.

Same four steps for every Fortinet line: inventory → fixed-price quote in 48 h → contract (BAIT/MaRisk/DORA hooks) → hand-over with spare-parts provisioning. Details on the Fortinet battle card.

Which Fortinet FortiGate branch and mid-market models do you service?

Complete branch and mid-market NGFW family: <strong>FortiGate 40-90 Series</strong> (FG-40F, FG-60F, FG-70F, FG-80F, FG-90G — branch/small-office), <strong>FortiGate 100-300 Series</strong> (FG-100F, FG-101F, FG-200F, FG-201F, FG-300E, FG-301E — mid-market). Plus older D generations (FG-100D, FG-200D, FG-300D — deployed in DACH fleets 2014-2017, EOSL reached or imminent at Fortinet) in refurbishing pool. Including all hardware components: PSUs (1+1 redundant from FG-200F, single PSU on FG-40F to FG-100F), fans (modular on FG-200F+, integrated on smaller models), eMMC/SSD modules for FortiOS and logging, mainboards, front panel LEDs, bezels, PoE+ port modules on models with integrated PoE ports and LTE modules on FG-60F-3G4G and FG-90G-LTE. For very old fleets (deployed pre-2014 with FG generations before D series) we check coverage individually.

What does hardware TPM cost for FG-60F, FG-200F and FG-301E vs FortiCare Premium Support?

30 to 60 percent savings on hardware maintenance component, plus additional bulk pricing levers for large fleets. Compared with FortiCare Premium for the hardware layer with 24×7×4, TechCare is roughly 55% below the Fortinet price for <strong>FG-40F</strong>, <strong>FG-60F</strong>, <strong>FG-90G</strong>, <strong>FG-100F</strong>, <strong>FG-200F</strong>, <strong>FG-201F</strong>, <strong>FG-300E</strong> and <strong>FG-301E</strong>. <strong>SD-WAN fleet with 100 FG-60F plus 20 FG-200F plus 5 FG-301E:</strong> annual maintenance roughly 55% below the Fortinet price, TPM migration pays back in first quarter. <strong>Bulk pricing:</strong> with 50+ FortiGate devices in one contract we negotiate additional 5-10 percent bulk discount. FortiGuard subscriptions stay independent at Fortinet.

How does hardware maintenance work for multi-site SD-WAN configurations?

<strong>Structured service for hundreds of branch sites</strong> explicitly our strength. Multi-site SD-WAN configurations have specific service requirements: <strong>standardized hardware configuration</strong> across all branches (typically all branches with same FortiGate model and same PSU/storage configuration), simplifying refurbishing pool logic and spare part reservation. <strong>Geographic service coverage:</strong> branch sites distributed across DACH (or pan-European), correspondingly onsite engineer availability in service regions. We deliver onsite service typically within 4 hours for 24×7×4 SLA in DACH main regions, NBD in regional sites. <strong>Bulk spare reservation:</strong> for fleets with 100+ identical FortiGate devices proactive spare reservation at main site or in regional hubs efficient — we deliver spare FortiGate devices as advance equipment with reduced reservation pricing terms. <strong>Multi-vendor SD-WAN consolidation:</strong> for DACH companies with mixed SD-WAN fleets (typically Fortinet plus Cisco SD-WAN plus VMware VeloCloud from historically grown acquisitions) we consolidate hardware maintenance across all SD-WAN vendors. <strong>FortiManager integration:</strong> hardware replacement on branch devices coordinated with your central FortiManager setup — we provide hardware replacement information for FortiManager configuration push, you push branch configuration to replacement device.

Do FortiGuard subscriptions, FortiOS and FortiCloud remain unchanged?

Yes, fully and unchanged. We service exclusively <strong>hardware layer</strong> — all software- and subscription-related continues via Fortinet. <strong>FortiGuard subscriptions:</strong> AntiVirus (signature updates typically every 5-15 minutes), IPS (intrusion prevention with daily signature updates), Web Filtering (categorized URL database with cloud lookup), AntiSpam, Application Control (thousands of application signatures for layer-7 filtering), FortiSandbox (cloud sandbox integration for unknown files), FortiClient EMS (endpoint management integration) — all continue unchanged via active FortiCare subscription. <strong>FortiOS software:</strong> code updates (major versions, maintenance releases, hotfixes) require active FortiCare software support. For very old devices (FG D generation from 2014-2017) FortiOS updates eventually no longer released — last supported FortiOS version is practical hardware EOL marker. <strong>FortiCloud:</strong> cloud services for logging, reporting and multi-site visibility run via Fortinet. <strong>FortiManager:</strong> central management of all branch firewalls runs via separate FortiManager appliance (hardware or VM), license and software support stay at Fortinet. <strong>FortiAnalyzer:</strong> central log aggregation and reporting runs via separate FortiAnalyzer appliance — hardware maintenance of FortiAnalyzer/FortiManager covered in our separate spoke.

How does HA-pair service with FGCP (FortiGate Cluster Protocol) work?

Branch and mid-market fleets typically deployed in <strong>FGCP HA-pair configuration</strong> (FortiGate Clustering Protocol by Fortinet) — two firewalls as redundant pair, one active (processes traffic), one passive (syncs state, takes over on failure). From TPM perspective pricing logic directly leverageable: <strong>Active node:</strong> 24×7×4 SLA for critical branches with business-critical SD-WAN connectivity (branches with real-time transaction processing, production sites with ERP connectivity), 5×9 NBD sufficient for standard branches with office workloads. <strong>Passive node:</strong> 5×9 NBD or Parts Only — active node services traffic during hardware swap of passive. This SLA differentiation saves additional 20-30 percent. <strong>FGCP-specific hardware coverage:</strong> HA-sync cabling (typically dedicated heartbeat ports), HA-sync configuration migration on mainboard replacement, HA cluster member replacement coordination with your FortiManager. <strong>Active/active FGCP:</strong> with active/active configurations (load-balanced traffic across both nodes) both nodes need 24×7×4 SLA because failure of any node directly reduces throughput. <strong>HA-sync hardware defects:</strong> defective HA-sync cables or HA-sync ports typically overlooked in OEM contracts — we explicitly service these because HA-sync defect operationally severe (cluster loses sync, both nodes interpreted as active, split-brain situation possible).

Which SLA levels do you recommend for branch and mid-market?

<strong>Branch sites (FortiGate 40-90):</strong> pricing leverage via HA-pair differentiation. Active nodes 24×7×4 for critical branches (branches with real-time transactions, production sites with ERP connectivity, logistics hubs with WMS integration), 5×9 NBD sufficient for standard branches with pure office workloads. Passive HA nodes default 5×9 NBD or Parts Only. <strong>Mid-market sites (FortiGate 100-300):</strong> typically deployed at HQ or datacenter edge, higher criticality — 24×7×4 for active nodes standard. Passive HA nodes 5×9 NBD. <strong>Single-WAN configurations without HA pair:</strong> 24×7×4 mandatory for critical branches because hardware failure directly loses internet access. <strong>SD-WAN multi-WAN configurations:</strong> hardware SLA can be more relaxed when at least 2 WAN paths configured (internet + LTE backup) because on FortiGate hardware failure LTE backup routing can work via alternative devices at site. <strong>Branch consolidation lever:</strong> with 50+ branch firewalls in one contract we negotiate bulk pricing additional to regular 30-60 percent TPM savings — typically another 5-10 percent extra. <strong>Multi-vendor consolidation:</strong> Fortinet FortiGate plus Palo Alto plus Check Point branch firewalls in one contract explicitly our strength.