Fortinet FortiGate 400-900 Maintenance
side by side.

FortiGate 400-900 Series · enterprise edge

FG-400F · FG-401F · FG-600F · FG-601F · FG-900G (36-360 Gbps throughput)

FortiGate 1000-3000 Series · high-performance datacenter

FG-1000F · FG-1500D · FG-1800F · FG-2000E · FG-2600F · FG-3000F · FG-3500F · FG-3700F (100-940 Gbps)

FortiGate 5000/6000/7000 chassis · carrier-class modular

FG-5001E (slot card) · FG-6300F · FG-6500F (high-density) · FG-7060E · FG-7081F (carrier chassis up to 1 Tbps+)

Older FG D generation · EOSL coverage

FG-100D · FG-200D · FG-300D · FG-500D · FG-800D · FG-1500D · FG-3700D (deployed 2014-2018, EOSL at Fortinet)

Chassis components · PSU/fan/linecards/fabric

Redundant PSU modules (3+1 or 4+1 hot-swap) · fan modules · linecards · fabric modules · backplane

Multi-chassis HA and datacenter cluster

Active/passive chassis · active/active FGCP · 2N datacenter edge cluster · carrier cluster

Lifecycle status of FortiGate enterprise and datacenter platforms

FortiGate enterprise and datacenter NGFW have <strong>highest absolute TPM lever</strong> in Fortinet ecosystem. FortiCare Premium Support for the hardware layer (premium without FortiGuard bundle) rises noticeably from FG-600F through FG-2600F to FG-3700F. For <strong>modular chassis</strong> another league: fully populated FG-7081F configurations are considerably higher again for the hardware layer, depending on linecard population. TPM reduces this 30-60 percent below. For a <strong>datacenter-edge fleet with 4 FG-3000F plus 2 FG-7060E</strong> (typical for tier-3 datacenter with 2N edge redundancy), annual maintenance with TechCare is roughly 55% below the Fortinet price — TPM migration pays back in first quarter. <strong>EOSL coverage as key differentiator:</strong> for DACH enterprise fleets with FG D generation hardware (FG-100D, FG-200D, FG-300D, FG-500D, FG-800D, FG-1500D, FG-3700D — deployed 2014-2018, now 7-10 years old) FortiCare Premium Support often <strong>no longer available for new contracts</strong> or only limited support delivered. TPM practically only maintenance option — absolute lever even higher because alternative either hardware refresh (substantial CapEx per firewall) or operational risk on component failure without service contract.

We service Fortinet FortiGate enterprise hardware with <strong>OEM original parts</strong> and deep refurbishing pools across all three generations and chassis classes. <strong>Current generations (FG F-Series, FG-900G):</strong> completely in active pool. <strong>EOSL platforms (FG D-Series):</strong> structured refurbishing pool — critical especially PSUs (most common failure component in hardware from 2014-2018 due to capacitor aging in 1+1 redundant PSU modules), fan cartridges (wear components with typically 5-7 year lifetime), NVMe/SSD modules (with finite write cycle reserve, typically exhausted after 5-7 years with active high-throughput logging) and mainboards (replacement with configuration migration via FortiOS backup). <strong>Chassis-specific coverage (FG-7060E/7081F, FG-6300F/6500F):</strong> linecard service with hot-swap logic — FortiGate chassis have dedicated linecards for different functions (NPU cards for network processing, FAB cards for fabric connectivity, management cards for slot management). Our engineers trained for FortiGate chassis architecture with service experience in <strong>service provider backbones</strong> (mobile backhaul with IPSec VPN aggregation, carrier ethernet aggregation), <strong>hyperscale datacenter edges</strong> and <strong>tier-1 carrier configurations</strong> with complex multi-chassis HA setups. Slot management and configuration migration on linecard replacement are core competencies.

The full OEM-vs-TPM matrix (spare parts, SLA tiers, language, sub-outsourcing, compliance docs, reporting) is the same for every Fortinet line — see the Fortinet battle card.

BAIT/MaRisk documentation package, DORA Art. 28 contract template, ISO 27001 and GDPR-compliant media handling apply identically to every Fortinet line — details on the Fortinet battle card.

Same four steps for every Fortinet line: inventory → fixed-price quote in 48 h → contract (BAIT/MaRisk/DORA hooks) → hand-over with spare-parts provisioning. Details on the Fortinet battle card.

Which FortiGate enterprise and datacenter models do you service?

Complete enterprise and datacenter NGFW family across three classes: <strong>Enterprise edge</strong> (FG-400F, FG-401F, FG-600F, FG-601F, FG-900G — 36-360 Gbps throughput), <strong>high-performance datacenter</strong> (FG-1000F, FG-1500D, FG-1800F, FG-2000E, FG-2600F, FG-3000F, FG-3500F, FG-3700F — 100-940 Gbps), <strong>modular carrier chassis</strong> (FG-5001E as slot card, FG-6300F/6500F as high-density chassis, FG-7060E/7081F as carrier-class chassis up to 1 Tbps+ NGFW throughput). Plus <strong>EOSL coverage</strong> for older D generations: FG-100D, FG-200D, FG-300D, FG-500D, FG-800D, FG-1500D, FG-3700D (deployed 2014-2018). Including all hardware components: redundant PSUs (1+1 from enterprise edge, 3+1 or 4+1 in chassis), fan cartridges (modular hot-swap), NVMe/SSD modules (dual-mirror configuration in enterprise class), mainboards, front panel LEDs, bezels, chassis linecards (NPU/FAB/management cards), fabric modules and HA-sync cabling. For very old configurations (linecards deployed 2014-2015) we check coverage individually per model.

What does TPM cost for FG-600F, FG-2600F, FG-3700F and chassis configurations vs FortiCare?

30 to 60 percent savings on hardware maintenance component — in the enterprise and chassis segment a substantial absolute lever. <strong>Enterprise edge:</strong> compared with FortiCare Premium with 24×7×4, TechCare is roughly 55% below the Fortinet price for FG-400F, FG-600F and FG-900G. <strong>High-performance datacenter:</strong> FG-1000F, FG-1800F, FG-2600F, FG-3000F and FG-3700F also roughly 55% below. <strong>Chassis configurations:</strong> FG-6300F/6500F, FG-7060E and FG-7081F fully populated each roughly 55% below the Fortinet price. <strong>Datacenter edge fleet with 4 FG-3000F plus 2 FG-7060E:</strong> annual maintenance roughly 55% below the Fortinet price. <strong>EOSL fleet:</strong> FG D generation often no longer supported by Fortinet — TPM pricing per model, with full EOSL coverage. FortiGuard stays independent at Fortinet.

What is coverage for older FG D models Fortinet set EOSL?

We are one of few TPM providers with <strong>structured refurbishing pool</strong> for FG D generation: FG-100D, FG-200D, FG-300D, FG-500D, FG-800D, FG-1500D, FG-3700D (released 2014-2017, deployed in DACH fleets 2014-2018, now 7-10 years old). This hardware generation still widespread in DACH enterprise fleets due to long hardware lifetimes. <strong>FortiCare Premium Support</strong> often no longer available for new contracts on these platforms or only limited support delivered. <strong>Our refurbishing pool</strong> covers critical failure components: <strong>PSUs</strong> (most common failure component in 8-10 year old hardware due to capacitor aging — we keep tested 1+1 redundant PSU modules), <strong>fan cartridges</strong> (wear component, typically 5-7 year lifetime — proactive replacement at 5-year maintenance recommended), <strong>NVMe/SSD boot drives</strong> (with finite write cycle reserve — typically exhausted after 5-7 years with active high-throughput logging) and <strong>mainboards</strong> (replacement with configuration migration via FortiOS backup). For very rare components (e.g. FG-3700D specific ASIC mezzanine cards) lead times possible — we recommend proactive spare component reservation for critical fleets. <strong>FortiOS version compatibility:</strong> FG D generation typically runs FortiOS 6.x/7.0 — newer FortiOS versions no longer released for older hardware, but threat-intel updates within last supported FortiOS version continue via active FortiCare subscription.

How does linecard hot-swap service for FG-7060E/7081F chassis work?

<strong>Modular chassis architecture</strong> allows linecard hot-swap without chassis stop — analog to Palo Alto PA-7000 chassis and Vertiv EXL S1 power module service, with Fortinet-specific implementation. <strong>NPU cards (Network Processing Units):</strong> hot-swap capable — with multi-card configuration remaining NPU cards take over traffic, defect card removable and replaceable during operation. Pre-conditions: sufficient redundancy in NPU population, traffic distribution configuration, FortiOS configuration considers card removal as planned maintenance event. <strong>FAB cards (fabric):</strong> backplane connectivity between slots — hot-swap with brief performance impact window during swap (typically under 60 seconds). <strong>Management cards:</strong> most critical card for chassis management — for FG-7081F with redundant management configuration second management card takes over, hot-swap of defect possible. <strong>Power Supply Modules:</strong> 3+1 or 4+1 hot-swap configuration per chassis — individual module replacement during operation without service impact. <strong>Fan modules:</strong> multiple hot-swap slots in chassis, individually replaceable with brief cooling window. <strong>Engineering coordination:</strong> our onsite engineer checks current redundancy configuration before each swap, coordinates with your FortiOS admin and performs card replacement according to documented hot-swap procedure. Slot management and configuration migration are core competencies — same service depth as FortiCare premium onsite service.

Do FortiGuard subscriptions, FortiOS and FortiManager integration remain unchanged for enterprise class?

Yes, fully and unchanged — same hardware vs software separation as branch and mid-market NGFW. We service exclusively <strong>hardware layer</strong> — all FortiGuard subscriptions (AntiVirus, IPS, Web Filtering, AntiSpam, Application Control, FortiSandbox, FortiClient EMS) and FortiOS software updates continue unchanged via Fortinet. <strong>Important for EOSL platforms:</strong> for FG D generation with EOSL status FortiGuard subscriptions also continue as long as hardware compatible with current FortiOS version. FortiOS versions eventually no longer released for older hardware — last FortiOS version supported for FG D generation (typically 7.0.x or 7.2.x) is practical hardware EOL marker. FortiGuard updates within last supported FortiOS version continue, often several years beyond hardware EOSL. <strong>FortiManager integration:</strong> central management of all enterprise and datacenter firewalls runs via separate FortiManager appliance — on FortiManager hardware defect we service hardware separately (see FortiAnalyzer/FortiManager spoke), FortiManager software license and updates stay at Fortinet. <strong>FortiAnalyzer:</strong> central log aggregation runs via separate FortiAnalyzer appliance — for datacenter configurations with high log volume critical for compliance reporting (NIS2, PCI-DSS, ISO 27001).

Which SLA levels do you recommend for enterprise edge, datacenter and carrier chassis?

<strong>Enterprise edge (FG-400/600/900):</strong> 24×7×4 for active nodes standard because hardware failure directly affects internet access or site connections. Passive HA nodes 5×9 NBD sufficient. <strong>High-performance datacenter (FG-1000/1500/1800/2000/2600/3000/3500/3700):</strong> 24×7×4 mandatory due to business-critical workloads (tier-1 datacenter traffic, cloud edge, service provider backbone). Passive HA nodes 5×9 NBD if active/passive, both nodes 24×7×4 if active/active FGCP. <strong>Carrier chassis (FG-7060E/7081F):</strong> 24×7×4 for all chassis mandatory, often with additional contractual availability guarantees (typically 99.99% to 99.999%) toward end customers. For service provider configurations we recommend additional <strong>spare linecard reservation</strong> on-site (typically 1 spare NPU card per 4-6 productive NPU cards) — on linecard failure replacement faster than any SLA response time. <strong>EOSL platforms (FG D generation):</strong> we recommend 24×7×4 for active nodes plus additional spare component reservation on-site because very rare components can have longer lead times. <strong>2N datacenter-edge cluster:</strong> with 2N redundancy second path counts operationally as immediate backup availability — TPM differentiation possible, individual risk assessment advisable. <strong>Power quality reports and quarterly audits</strong> additional to hardware SLA recommended for regulatory documentation (NIS2, critical infrastructure for relevant datacenter sites).