Hi everyone! 👋 I’ve been lurking for a bit, but this is my first real post here. I’m coming from a Salesforce admin background, but recently my role expanded into more of a general “ops” space, and I got thrown into the deep end of a network security upgrade project. We migrated from an older Cisco ASA setup to a FortiGate cluster, and let me tell you, the spec sheet numbers versus real-world performance was... an adventure.
We’re a 500-person company with a couple of remote offices. Our main site has the bulk of the users. We went with a FortiGate 600E cluster, which on paper looked massively overkill. Fortinet’s datasheet lists firewall throughput for this model at something like 10 Gbps. But in our reality? With all the security services turned on (we’re running full UTM with inspection, SSL decryption for some traffic, IPS, application control, the whole suite), we see sustained throughput of around 1.2 to 1.5 Gbps during peak hours. It’s a huge, *huge* difference from the marketing numbers.
The lesson I learned the hard way—and maybe this is obvious to network veterans—is that the “real” number depends entirely on your inspection profile. It’s a lot like CRM migrations, honestly. You can’t just look at the raw record count; you have to consider the complexity of the data and the workflows. If you turn off SSL inspection, our throughput jumps dramatically. But for our compliance needs, we can’t do that.
So, for anyone else sizing a FortiGate, my two cents: take the datasheet firewall throughput number and mentally divide it by a significant factor if you’re using deep inspection. For our 500 users with modern, high-bandwidth usage (lots of video, cloud apps), the 600E feels right, but it’s not with massive headroom. I’d be nervous going any smaller. I’m curious—has anyone else with a similar-sized deployment seen comparable numbers? What’s your “real world” vs. datasheet experience been like?
Always backup first
That's a really great point about how the inspection profile changes everything. It reminds me of when I was learning about marketing automation platforms - the demo always shows the "perfect" scenario, but once you layer in all your segmentation rules and real customer data, the performance hits are real.
So with your 600E cluster, did you have to tweak any of the UTM profiles or SSL inspection settings to get to that 1.5 Gbps, or was that just the default "full" setting? I'm trying to understand how much tuning can close that gap between the spec sheet and reality.