What You’re Really Paying For When You Buy a FortiGate
Two licenses, one invoice: what keeps a FortiGate protecting your network
TL;DR: A FortiGate purchase is really two separate licenses riding on one invoice, and only one of them stops the box from going blind to new threats without any outward sign of it. This post traces what FortiCare and FortiGuard each actually cover and what happens the day either one lapses. The device keeps passing traffic either way; whether it’s still protecting anything depends entirely on which license you let expire.
Here’s a question that seems like it should have an obvious answer and somehow doesn’t: when you buy a FortiGate, what exactly are you licensing? It looks like a straightforward hardware purchase, but the invoice is doing more work than that, and a lot of buyers don’t find out how much until renewal time catches them off guard.
The real answer is that you’re licensing two separate things that happen to arrive on the same purchase order. Think of it like buying a car with a roadside-assistance plan and a separate subscription for the safety features that need constant updates to work, like a collision-avoidance system that needs current map data to know what it’s looking at. The car runs without either one. It just doesn’t do everything you bought it to do, and you won’t necessarily notice what’s missing until the moment you need it.
We’re writing this because it’s the single most common source of confusion (and, occasionally, unpleasant surprise) we see with FortiGate deployments. It’s not a knock on Fortinet specifically; every serious security vendor structures licensing this way, hardware plus a subscription for the services that need continuous updates. But Fortinet’s specific terminology, FortiCare and FortiGuard, plus a set of bundle names that shift over time, creates a specific kind of confusion that’s worth untangling directly.
This sits inside a bigger decision every firewall buyer eventually runs into: the hardware you buy and the security bundle you license are two separate purchases. Here’s what that split means, and what it costs you the day one half of it lapses.
Table of Contents
- FortiCare vs FortiGuard: Two Licenses, Two Jobs
- The FortiGuard Bundles, and What Each One Switches On
- How Renewal Works, and Co-Terming a Fleet
- What Actually Stops Working When a FortiGuard License Expires
- Licensing and Firmware: A Connection Worth Knowing About
- The Part of the Job Nobody Signed Up For
- The Line Item That Decides Whether You’re Protected
- Key Takeaways
- Frequently Asked Questions
FortiCare vs FortiGuard: Two Licenses, Two Jobs
Start with the basic split, because everything else builds on it. We touched on this in our previous post on NGFW vs UTM: the hardware you buy and the license you attach to it are two decisions, not one. Here’s the FortiGate-specific version of that split. FortiCare is Fortinet’s support and hardware warranty program: firmware updates, hardware replacement, and access to technical support when something breaks. It’s the “if this box has a problem, someone will help you fix it” license.
FortiGuard is a different animal entirely: it’s the subscription that keeps the box’s security intelligence current. Antivirus signatures, intrusion prevention rules, web filtering categorization, and application control definitions all need continuous updates to stay useful against threats that didn’t exist when the box was manufactured. FortiGuard is what keeps a FortiGate’s security features from slowly going stale.
The confusion happens because both show up as line items on the same renewal quote, both have their own tier names, and it’s genuinely easy to renew one and assume you’ve covered both. You haven’t. They’re separate, and a gap in either one has different consequences, which we’ll get into.
FortiCare support tiers generally differ on two axes: how fast Fortinet commits to responding to a support ticket, and what level of proactive service comes bundled in, things like configuration assistance or more direct escalation paths for complex issues. For a mid-market organization without a dedicated network engineer on staff, the difference between tiers often comes down to how much you’re willing to lean on Fortinet’s support directly versus routing through a managed provider who already knows your environment. That’s often where a partner earns their keep: not just relaying a support ticket to Fortinet, but confirming the configuration is correct in the first place, since a lot of what looks like a support issue is really a configuration one.
The FortiGuard Bundles and What Each One Switches On
Fortinet packages FortiGuard services into bundles, and the specific bundle names and contents shift periodically as the security landscape and Fortinet’s own product lineup evolve. Rather than publish a table here that will be obsolete within a year (a mistake we’ve seen plenty of vendor blogs make), the useful thing to understand is the structure: bundles generally scale from a baseline covering antivirus and basic web filtering, up through mid-tier bundles adding intrusion prevention and application control, up to enterprise-level bundles adding advanced threat protection like sandboxing and more sophisticated behavioral detection.
A note on the details above: Fortinet periodically updates the specific bundle names and what’s included in each one, so confirm the current lineup in Fortinet’s ordering guide before you buy. The tiered structure, baseline, mid-tier, enterprise, has stayed consistent; it’s the exact names and inclusions that shift.
The practical takeaway: know specifically which services your current bundle includes, not just which bundle name is on the invoice. “We have the enterprise bundle” is a start. “We have sandboxing and behavioral detection actively enabled and updating” is the answer that tells you what’s protecting your network.
How Renewal Works, and Co-Terming a Fleet
If you have one FortiGate at one site, renewal is straightforward: track the expiration date, renew before it lapses. If you have a fleet across multiple locations, purchased at different times, you’ve likely got a spread of renewal dates that’s easy to lose track of, and losing track of even one is how a license lapse happens unnoticed at a branch office nobody’s watching closely.
Co-terming, aligning every device’s renewal to a single date, solves this at the cost of some complexity in the year you set it up (you’re either extending some licenses or shortening others to sync them). For any organization running more than two or three FortiGates, co-terming is worth the one-time hassle; a single annual renewal date is a lot easier to manage than a scattered calendar of expirations you’re hoping someone remembers.
What Actually Stops Working When a FortiGuard License Expires
Here’s the section that matters most, and the one we get asked about most directly: what happens the day a FortiGuard subscription lapses?
The direct answer, and this surprises people: the firewall keeps forwarding traffic. It doesn’t shut down. What happens instead is more subtle, and in some ways more dangerous: the security services tied to that license stop updating. Antivirus signatures freeze at whatever they were on the day of expiration. Web filtering categorization stops receiving new site classifications. Intrusion prevention signatures stop updating against new attack patterns. The box looks like it’s working exactly the same as it did the day before, because from a connectivity standpoint, it is. It’s just no longer defending against anything that’s emerged since the license lapsed, which, in security terms, is most of what matters.
This is precisely why a lapsed FortiGuard license is a business risk conversation, not just an IT housekeeping item: an org can go months without incident on an expired license and read that as evidence the lapse doesn’t matter, right up until it very much does. For a SOC actively monitoring the environment, a lapsed license also means the telemetry that monitoring relies on starts degrading, which is its own separate problem.
If cost pressure ever puts “let the FortiGuard subscription lapse” on the table as an option, it’s worth being direct about what that decision is: not “saving money on a renewal,” but “choosing to run production security infrastructure on threat intelligence that stopped updating on a specific date in the past.” Some organizations make that tradeoff consciously for a specific, time-boxed reason. Very few would make it consciously as a permanent state, once it’s framed accurately.
Licensing and Firmware: A Connection Worth Knowing About
One more thing worth flagging here because it catches people off guard later: an expired FortiCare license can block your ability to upgrade firmware, since firmware upgrades are typically gated behind active support entitlement. That means a lapsed FortiCare subscription doesn’t just mean slower support response; it can mean you’re stuck on an aging firmware version even if you want to move forward. We go more into planning a firmware upgrade path correctly, including this exact dependency, in our companion post on FortiGate upgrades, which is worth reading before your next maintenance window, regardless of where your licenses currently stand.
The Part of the Job Nobody Signed Up For
Most business owners didn’t get into their industry to become experts in firewall licensing cycles, but that’s increasingly the relationship modern business has with its own technology: intricate, ongoing, and rarely what anyone planned on managing when they started the company.
Tracking renewal dates across a fleet, knowing what each bundle includes at any given time, and making sure a license never lapses unnoticed at a location nobody’s watching closely, none of that was in the original job description. It’s also exactly the kind of operational discipline a managed security relationship is built to absorb.
Licensing and renewal tracking is part of the security management services Secureway provides, built on the same 24/7/365 SOC discipline behind everything else in this series, so the licensing questions in this post become one less thing to personally stay on top of. Even the purchasing side of this, deciding where to actually buy a FortiGate license in the first place, has more channel options than most buyers realize, which we cover separately in our post on where mid-market buyers source FortiGate licenses.
The Line Item That Decides Whether You’re Protected
FortiCare and FortiGuard aren’t two names for the same renewal; they’re two different jobs: one keeps the hardware supported and upgradeable, the other keeps the box’s threat intelligence current. Bundle names shift, renewal dates drift out of sync across a fleet, and a FortiGuard lapse never announces itself; the firewall keeps passing traffic exactly as before. The only thing that changes is what it’s still defending against.
That’s what makes this particular gap different from most IT problems: it doesn’t force a decision. Nothing crashes, nothing alerts, nothing requires anyone to act. The risk just sits there accumulating until the day something gets through that current signatures would have caught, and at that point, the conversation isn’t about a renewal anymore.
This is the kind of gap that’s easy to miss when licensing lives on a spreadsheet somewhere and hard to miss when it’s someone’s actual job to watch. Secureway IT catches a co-terming mismatch or a bundle downgrade before it becomes a live problem, not through any special insight, but because tracking it and confirming the configuration behind it is still correct, is what we do instead of the dozen other things competing for an internal team’s attention. That’s the difference between licensing as a line item nobody’s watching and licensing as something somebody is actively watching and verifying.
Is your company’s firewall still defending against what’s out there this week, or against whatever was current when the license was last renewed? Connect with Secureway IT to find out exactly what your current licenses are still defending against.
Key Takeaways
- FortiCare (support and hardware) and FortiGuard (security service updates) are two separate licenses on one invoice; renewing one doesn’t cover the other.
- Bundle names and contents shift over time, so know which specific services your current bundle includes, not just the bundle’s name.
- Co-terming renewal dates across a fleet is worth the one-time setup cost for any organization running more than two or three devices.
- A lapsed FortiGuard license doesn’t shut the firewall down; it freezes security updates while the box keeps passing traffic, which is easy to miss and often more dangerous than an outright outage.
- An expired FortiCare license can block firmware upgrades, a dependency worth knowing before your next maintenance window.
Frequently Asked Questions
FortiCare covers hardware support and firmware update access. FortiGuard covers the security service updates, like antivirus signatures and intrusion prevention rules, that keep the box’s protection current. They’re licensed and renewed separately.
The firewall keeps forwarding traffic, but the security services tied to that license stop updating: threat signatures freeze at their last update, and protection against anything new effectively stops.
Technically, yes, the hardware keeps functioning, but you’d be running production security infrastructure on threat intelligence that stopped updating on a specific past date. It’s rarely a sound permanent choice, even when it’s sometimes a deliberate short-term one.