FortiGuard and FortiCare licensing covers the two subscription layers Fortinet sells on top of its hardware and software. FortiGuard is a service that provides updates such as threat databases and signatures for Fortinet products, and FortiCare is “a time-based subscription to Technical Support Services”.[1] Both are Service Contracts under the Fortinet Service Terms & Conditions, which also bind the customer to the Fortinet EULA for the underlying products.[1] A Service Contract is a term-based subscription that must be registered with Fortinet, and it applies to one Product unit or Support Portal account.[1] For a FortiGate, the practical result is that every appliance carries its own FortiCare and FortiGuard contracts, bought either as a bundle or service by service, with start dates set by registration or by the Grace Period Policy.
Editions
FortiGuard bundles
Fortinet offers three curated bundles for FortiGate hardware, virtual machines and SaaS, plus an SD-WAN bundle, and allows services to be bought individually a la carte.[2] The ordering guide describes the Enterprise (ENT) bundle as providing comprehensive attack surface security, UTP essential web and network defence, and ATP “a powerful first line of defense”.[2] The FortiFlex service-offerings table for the FortiGate virtual machine, which lays the bundles out in separate columns, lists their contents as follows:[3]
| Bundle | Services included | Support |
|---|---|---|
| Advanced Threat Protection (ATP) | IPS, application control, Advanced Malware Protection | FortiCare Premium 24x7 |
| Unified Threat Protection (UTP) | ATP plus URL, DNS and video filtering, and anti-spam | FortiCare Premium 24x7 |
| Enterprise Protection | UTP plus DLP, inline CASB database, AI-based inline malware prevention, attack surface security and the FortiConverter service | FortiCare Premium 24x7 |
The FortiGuard ordering guide confirms that AI-based inline malware prevention is included in the Enterprise Protection bundle or available separately a la carte, and that zero-day detection in the ATP and UTP bundles comes through cloud-based sandbox services.[2] Advanced Malware Protection groups antivirus, botnet domains, mobile malware, virus outbreak protection, content disarm and reconstruction, AI-based heuristic antivirus and FortiGate Cloud Sandbox.[2]
All bundles include FortiCare Premium 24x7x365 technical support (rule).[2] A set of base update services, including application control signatures, inline CASB definitions, device and OS detection, GeoIP, trusted CA certificates, the Internet Service Database, PSIRT check and anti-phishing patterns, is included with every FortiCare support contract whether or not a bundle is bought.[2]
FortiCare levels
The FortiCare Services ordering guide describes Premium as dedicated 24x7x365 support for each product and service, and Elite as Premium plus higher SLAs and extended end of support (EEoS), with access to the FortiCare Elite portal.[4] For FortiGate, Premium commits to one hour for P1 and P2 telephone escalations and next business day for P3 web escalations, while Elite commits to 15 minutes and two hours.[4] FortiCare Essentials is a web-support-only level for price-sensitive deployments, limited to desktop models.[4][2]
Per-device add-ons extend hardware replacement. Premium and Elite contracts include next-business-day RMA delivery; Priority RMA (next calendar day, four-hour delivery, or four-hour delivery with an onsite engineer) and Secure RMA (the defective unit is not returned) are sold as add-ons in one, three and five-year terms, and PRMA requires an active Premium or Elite contract on the device.[4] Account-level Advanced Support (Core, Pro and Pro Plus) and Professional Services are sold separately.[4]
SKU structure
Ordering guides show FortiGuard and FortiCare SKUs coded by device model and service. For a FortiGate 60F, the Enterprise bundle is FC-10-0060F-809-02-DD, the UTP bundle FC-10-0060F-950-02-DD, the ATP bundle FC-10-0060F-928-02-DD, and 24x7 FortiCare alone FC-10-0060F-247-02-DD; hardware sold together with a bundle uses SKUs such as FG-60F-BDL-950-DD.[2] The Elite add-on for a FortiGate 100F bundle is FC-10-F100F-204-02-DD.[4] Commentary: the model code in the SKU ties the contract to a hardware model, and registration ties it to a serial number, which is why FortiGuard and FortiCare entitlements are reconciled against the device inventory rather than a pooled quantity.
Metrics
The only metric is the Product unit (per device). The Service Terms state that Service Contracts “may apply only to a single unit of Product or Support Portal account(s)” and that each unit “will require its own separate Service Contract to receive Service”.[1]
Counting / floors
One contract per unit
Using, or attempting to use, a Service Contract with a unit other than the one it was bought and registered for is a material breach: the contract is terminated without refund and fees for the additional Services become due at Fortinet’s then-current list price (rule).[1] FortiGuard updates are provided only for the Product covered by a FortiGuard Service Contract, and unauthorised use of updates, such as accessing signature packages for duplication, is excluded (rule).[1] When a unit is replaced under RMA, the customer must transfer its Service Contracts to the replacement, and FortiGuard services can take up to four hours to re-establish.[1]
Fortinet may terminate Service Contracts when the Product unit is transferred to a third party, when a contract is used for a Product other than the entitled one, or for non-payment.[1] Under the EULA, licence, warranty and support are only available for Products bought from Fortinet or an authorised Channel Partner, and other Products may be blocked from registration (rule).[5]
HA clusters
Because contracts are per unit, each member of a FortiGate cluster normally needs its own. The FortiOS administration guide documents one exception: for FortiGate 40F, 60F, 70F, 80F and 100F models and variants, two units bought with the HA SKU (for example 2 x FG-40F-HA) can share a single Enterprise Protection, UTP or ATP subscription registered to a virtual serial number (vSN) that joins both serial numbers (rule).[6] A la carte SKUs cannot be registered to the vSN, and after registration the individual FortiGates cannot be managed separately in Asset Management.[6]
Registration and start dates
A new Service Contract or Product Bundle starts on its Registration Date.[1] If the customer does not register, the Service Contract Activation and Grace Period Policy starts it automatically. Hardware-attached contracts (FortiCare, PRMA/SRMA and FortiGuard) have a 90-day grace period, or 60 days when shipped to the United States or Canada (rule); non-hardware-attached contracts, including VM subscriptions and FortiCare or FortiGuard for non-hardware products, have 60 days in all regions (rule).[7] The grace period starts at shipment or at generation of the contract number, and the policy does not apply to Enterprise Agreement orders, renewals with predefined start dates or perpetual licences.[7] Some stand-alone Service Contracts not registered in line with the activation policy may be forfeited.[1] A Product bought without any Service Contract must still be registered for licence, RMA and warranty coverage (rule).[1]
Renewals
Service Contracts are for a set duration and do not auto-renew (rule).[1] A Renewal Service Contract starts on the calendar day after the previous contract expired, to maintain a continuous service period. When the renewal is registered more than 180 days after that expiry, the start date becomes 180 days before the actual registration date (rule).[1] The FortiOS documentation calls this the FortiCare/FortiGuard Renewal Continuous Service Policy and states that “any lapses in the service will require coverage back to the contract expiration date”.[8] Fortinet may register renewals and upgrades automatically once a purchase order has been placed, but registration remains the customer’s responsibility.[1] To align end dates when services are added to an existing unit, customers request a co-term quotation from a Fortinet-authorised partner.[2] Existing customers upgrade to Elite with a co-term SKU such as FCZ-10-F100F-204-02-DD.[4]
Commentary: the back-dating rule means that a late renewal buys the lapsed months. A renewal registered 120 days after expiry still starts on the day after expiry; one registered 300 days after expiry starts 180 days before registration, so the customer pays for 180 lapsed days rather than 300.
Effect of expiry
A FortiGate “will still function as a firewall” if some or all FortiGuard licences are expired, but the services degrade differently (rule).[8] IPS, antivirus, application control and OT signatures keep working with their last databases, which are no longer updated. Services that depend on real-time FortiGuard lookups stop: category-based web and DNS filtering (by default all web and DNS traffic is then dropped), anti-spam, outbreak prevention and paid security rating checks.[8] When the Firmware & General Updates licence is invalid, FortiOS 7.4.9, 7.6.4 and later schedule a required upgrade to the latest patch of the current minor version, which can be postponed in seven-day steps but not cancelled (rule).[9]
Product life cycle
The level of FortiCare support can vary with the product’s life cycle phase. For software in the End of Support phase, Fortinet may provide advisory support at its discretion without new releases to fix defects, and hardware in End of Support is excluded unless the coverage level says otherwise.[1] FortiCare Elite’s extended end of support is only available on designated Long Term Support (LTS) releases (rule).[4]
Virtualization & partitioning
FortiGuard bundles are sold for FortiGate virtual machines as well as hardware; for the FortiGate-VM S-series, the support-bundle code in the SKU selects the bundle.[2][10] Contracts for virtual products are non-hardware-attached under the Grace Period Policy.[7] See FortiGate-VM licensing.
Cloud / BYOL
A FortiGate-VM bought through a cloud marketplace comes with the UTP bundle.[10] FortiGuard and FortiCare services for FortiGate hardware can also be consumed through FortiFlex, but only for hardware that has no services already attached, and the Continuous Service Policy does not apply to FortiFlex entitlements (rule).[3] See FortiFlex and FortiPoints.
Programs
- FortiGuard Security Bundles and FortiCare Support Services, described above.
- The Enterprise Agreement Program provides multiple Service Contracts through prior agreement; Fortinet registers them automatically with the effective date it communicates, and section 5.2 of the Service Terms does not apply (rule).[1]
- Co-term aligns the end dates of new and existing services.[2]
Out of scope
This article does not cover FortiGuard services sold for products other than FortiGate (for example FortiWeb or FortiMail), professional services and training contracts, which have a 365-day grace period after which one-year contracts are forfeited, FortiGuard Incident Response Readiness contracts,[7] or the Fortinet Product Life Cycle Policy itself, which is published on the login-protected support portal.