I am currently performing a TCO analysis for a fleet of FortiGate 100E appliances deployed approximately 36 months ago. The upcoming 3-year renewal for FortiCare Support and FortiGuard UTM subscriptions presents a significant cost event, often rivaling 50-60% of the original hardware's effective street price. The core question for this review thread is whether this capital outlay is justified, or if the hardware's age and performance trajectory make a hardware refresh or platform migration the more rational choice.
Let's establish a performance and capability baseline for the FG-100E (model introduced circa 2017, using a Cavium ARMv8 CP9 NSA). Based on my internal benchmarks and Fortinet's published datasheets (FG-100E datasheet, v6.4), the unit has the following constrained ceilings under typical UTM profiles:
* **Threat Protection Throughput:** ~650 Mbps
* **IPS Throughput:** ~700 Mbps
* **NGFW Throughput:** ~250 Mbps
* **Concurrent Sessions (TCP):** ~1,000,000
* **New Sessions/Second:** ~12,000
In a modern context, these figures are suitable for a 500-800 Mbps internet circuit with UTM enabled. The critical constraints are:
1. SSL Inspection performance (not listed above) is the primary bottleneck, often reducing effective throughput by 60-70% when enabled.
2. The CP9 processor lacks dedicated ASICs for certain offloading tasks present in newer SoC4 (100F+) or SOC5 (70F+) platforms.
A three-year renewal for FortiCare and a comprehensive UTM bundle (IPS, AV, AppCtrl, Web Filtering) for a single FG-100E currently lists in the **$1,800 - $2,400 range** (pre-negotiation). This must be evaluated against alternatives:
**Alternative 1: Refresh to a newer model (e.g., FortiGate 100F)**
* **Hardware Cost:** ~$2,500 - $3,000 (street)
* **3-Year Subscription:** ~$2,200 - $2,800
* **Total 3-Year Cost:** **~$4,700 - $5,800**
* **Advantage:** You gain 3-5x the Threat Protection throughput (~2.5 Gbps), integrated SSD for logging, and access to newer features (SASE connector, enhanced SD-WAN). The new subscription clock starts now.
**Alternative 2: Continue with existing 100E**
* **Hardware Cost:** $0 (sunk)
* **3-Year Subscription Renewal:** **~$1,800 - $2,400**
* **Total 3-Year Cost:** **~$1,800 - $2,400**
* **Advantage:** Lower immediate capex. However, you are investing in aging hardware with no performance gain and increasing risk of hardware failure outside of the renewed warranty period.
From a purely financial perspective, renewing the 100E is the lower-cost option over the next 36 months. However, the technical debt is substantial. You are committing funds to a platform that is already at or near its performance limit for many environments. The renewal cost per Mbps of protected throughput is disproportionately high compared to a new unit.
**Recommendation Framework:**
* **Renew the 100E if:** Your internet bandwidth is ≤ 500 Mbps with no planned upgrades, SSL Inspection is not broadly deployed, and your session table/utilization is consistently below 50%. This is a holding pattern.
* **Upgrade to a newer FortiGate (e.g., 100F) if:** Your bandwidth is increasing, you require deeper SSL inspection, or you anticipate leveraging newer features. The cost per protected Mbps and per new session/second is significantly better.
* **Consider a platform shift (if applicable):** For greenfield scenarios, I would benchmark against Palo Alto PA-440 or Cisco Firepower 1120, but that's a separate analysis.
Concrete data point: In our environment, we migrated from 100E to 100F and saw a 320% improvement in IPS throughput with full SSL inspection enabled, effectively allowing us to consolidate two 100E units into one 100F. The renewal cost for the two old units was nearly identical to the cost of one new 100F with a 3-year subscription.
I am interested in the community's real-world data: What effective throughput are you sustaining on 100E units with modern threat signatures enabled? Has anyone performed a similar TCO analysis and chosen to renew, and what was the breaking point?
Test it yourself.