FortiFlex is Fortinet’s usage-based licensing program. Instead of buying a fixed licence per product, the customer creates entitlements in the FortiFlex portal and consumes points, which are calculated daily from each entitlement’s configuration.[1] FortiFlex covers virtual machines such as FortiGate, FortiManager, FortiAnalyzer, FortiWeb and FortiADC, FortiGate hardware services, SaaS offerings such as FortiGate Cloud and FortiSASE, and endpoint products such as FortiClient EMS and FortiEDR Cloud.[1] It comes in two forms: FortiFlex Enterprise, “a prepaid, points-based subscription model”, and FortiFlex MSSP, a postpaid model for managed security service providers and telcos billed monthly on consumption.[2] FortiPoints is a separate points currency that can be converted into FortiFlex points.[2] Both are Service Contracts under Fortinet’s Service Terms and the Grace Period Policy, and the underlying products remain licensed under the Fortinet EULA.[3][4]
Editions
| Program | Payment | Program SKU | Points |
|---|---|---|---|
| FortiFlex Enterprise | Prepaid | FC-10-ELAVR-221-02-DD (12, 36 or 60 months) | Point packs bought in advance |
| FortiFlex MSSP | Postpaid, billed monthly | FC-10-ELAVS-221-02-12 | Consumption billed monthly (FCB-ELAVM SKUs) |
The ordering guide adds separate program SKUs, FLXGR (prepaid) and FLXGS (postpaid), for use directly by government entities or when a partner delivers FortiFlex as a service. A program SKU is required for every new FortiFlex activation or renewal.[2] The program requires a primary FortiCloud account or IAM user, a program SKU, and, for the prepaid program, point pack SKUs, all bought from Fortinet resellers and distributors.[5] A FortiFlex account can hold one prepaid program and one postpaid program at the same time.[6]
Metrics
- FortiFlex Point: “Resource consumption is based upon predefined points that are calculated on a daily basis (PST/PDT time zone).”[6]
- FortiPoint: the FortiCloud points currency that “can be converted into FortiFlex credits and added to an active FortiFlex balance via FortiMarketplace”.[2]
Each entitlement consumes the points rate of its configuration. For VMs the rate depends on the number of CPUs and the service package; for other products on the service type and quantity (for example endpoints for FortiClient EMS or GB of daily storage for FortiAnalyzer-VM).[6][7]
Counting / floors
Configurations, entitlements and tokens
Customers define reusable configurations and create entitlements from them; each entitlement corresponds to one licensed asset. Changing a configuration changes every entitlement that uses it. In Fortinet’s example, raising a FortiGate-VM configuration from four to eight vCPUs applies to all ten VMs using it at their next licence update.[1] Every VM needs its own unique licence token.[1]
Daily calculation
Points are calculated on PST/PDT days from the number of CPUs and the service package. Entitlements can be changed as often as needed within a day, but the largest CPU size and service package of that day is charged. Points are not calculated while an entitlement is stopped, even if the VM is still running in the customer’s environment (rule).[6] Daily rates are locked: the Current Pricing in the points calculator uses the fixed ratings from program registration, valid for up to one year and not subject to changes in program ratings, and the Latest Pricing applies after the next anniversary (rule).[8]
Commentary: because FortiFlex charges the day’s peak, scaling a VM up for an hour costs a full day at the larger size. Stopping unused entitlements, not just shutting down VMs, is what ends consumption.
Entitlement limits and minimum terms
The FortiFlex service-offerings page sets limits per product. Examples:
| Offering | Unit | Range |
|---|---|---|
| FortiGate-VM (bundle or a la carte) | vCPUs | 1 to 96, increments of 1; VDOMs up to 10 (VM01), 25 (VM02-VM03), 50 (VM04-VM07), 500 (VM08-VM96) |
| FortiManager-VM | Managed devices | 1 to 100,000; ADOMs on top of the base five |
| FortiAnalyzer-VM | Daily storage (GB) | 5 to 8,300; ADOMs 0 to 1,200 |
| FortiClient EMS (on-premises or cloud) | Endpoints | 25 to 85,000 |
| FortiNAC-VM | Endpoints | 25 to 100,000, increments of 25 |
| FortiSASE | Data transfer, branch on-ramp locations, compute regions | Data transfer up to 2,500,000, increments of 250 |
Source: FortiFlex service offerings.[7] FortiAP, FortiSwitch and FortiExtender entitlements must stay active for at least 30 days after creation, FortiSASE and FortiRecon entitlements have a 90-day minimum term, and only one FortiRecon or SOCaaS entitlement is allowed per account except during migration (rule).[7]
Hardware entitlements
FortiGate hardware remains customer-owned. Only hardware without services already attached can be added to FortiFlex; services attached through a normal contract must first be detached by customer service. The Continuous Service Policy, which back-dates ordinary renewals, does not apply to FortiFlex entitlements.[7] Hardware entitlements can carry FortiCare Premium or Elite and the ATP, UTP or Enterprise bundles; the FortiCare Elite upgrade can only be combined with one of these bundles.[7]
Point packs and commitments
Prepaid points are bought in units of 1,000, 10,000, 50,000 and 100,000 points and deducted daily.[6] The ordering guide lists stackable bulk packs such as LIC-FLXPTS-BULK-50K-DD with 100% roll-over and expiry three years after registration, and a 1,000,000-point pack (minimum order 1,000,000 points) that expires after five years.[2] All FortiFlex SKUs must be registered within 365 days of purchase, after which unregistered programs and points are forfeited. The MSSP program requires a minimum annual consumption commitment of 50,000 points; if annual consumption is lower, a true-up adjustment is applied (rule).[2] Under the Grace Period Policy, FortiFlex and FortiPoints purchases are non-hardware-attached Service Contracts that start automatically 60 days after shipment or contract-number generation if not registered (rule).[3]
Roll-over and expiry
Unused prepaid points roll over in full on the registration anniversary for stackable and bulk packs. The administration guide states that stackable packs expire three years from purchase and bulk packs three or five years from purchase. Postpaid programs have no roll-over (rule).[6] If the program expires, new points cannot be added, and all unconsumed points are forfeited 90 days after expiry.[6]
Grace periods and overuse
FortiFlex has two 90-day grace periods (rule):[9]
- Program Expiration applies to prepaid and postpaid programs. Entitlements set to the Follow Program termination mode keep their FortiGuard services for 90 days after the original expiry, although the portal shows them as expired. Unused prepaid points stay valid if the program is renewed within the grace period and are fully forfeited otherwise.[9]
- Negative Points applies only to prepaid programs. Points can be consumed into a negative balance for up to 90 days and are trued up automatically when new packs are added. If the balance is still negative when the grace period ends, all active entitlements are stopped until the balance is positive.[9]
During either grace period, entitlements cannot be created or updated; existing active entitlements continue and points are still deducted.[9]
Virtualization & partitioning
FortiFlex does not change how the underlying products count: a FortiGate-VM entitlement is sized in vCPUs and VDOMs, a FortiManager-VM in managed devices and ADOMs, and a FortiAnalyzer-VM in daily storage.[7] VMs can be deployed on the customer’s supported clouds and hypervisors once the token is injected.[1] See FortiGate-VM licensing.
Cloud / BYOL
FortiFlex VMs are deployed on the customer-managed platform in supported clouds and hypervisors.[1] Commentary: this makes FortiFlex a bring-your-own-licence model in cloud terms, with compute and storage billed by the cloud provider as for other BYOL FortiGate-VMs.[10] FortiFlex also covers Fortinet SaaS, including FortiSASE, FortiGate Cloud, FortiAnalyzer Cloud, FortiManager Cloud, SOCaaS and FortiSIEM Cloud.[1][7]
Programs
FortiPoints
FortiPoints balances can be converted into FortiFlex points through FortiMarketplace. The transfer is final and non-reversible, and the rate depends on volume: below 50,000 FortiFlex points, 1 FortiFlex point costs 1.2 FortiPoints and transferred points are valid three years; from 50,000 to 999,999 the rate is 1:1 with three-year validity; above 1,000,000 the rate is 1:1 with five-year validity (rule).[2] The administration guide adds that conversion is available only for prepaid programs at the root account level.[6]
Relationship to other programs
The MSSP program is the route for partners that deliver chargeable services, which end-user Service Contracts exclude.[11][2]
Out of scope
This article does not cover the FortiFlex points calculator’s per-product daily rates, which Fortinet provides through the FortiFlex points calculator rather than in the cited documents, the FortiFlex API and automation tools, or cloud-marketplace private offers.