Fortinet licensing covers a security portfolio built around the FortiGate next-generation firewall and the FortiOS operating system, extended by FortiGuard security subscriptions, FortiCare support, virtual and cloud appliances, the FortiClient endpoint agent, the FortiManager and FortiAnalyzer management and analytics products, and the FortiSASE service. A single Product License Agreement (EULA) governs hardware appliances, the software and firmware in them, and stand-alone software including subscriptions, cloud software and on-premises software.[1] Support and security subscriptions are also governed by the Fortinet Service Terms & Conditions, which apply to FortiCare, FortiGuard and other Service Contracts.[2] The EULA grants the licence subject to “license metrics, term limitations, or restrictions” set out in Fortinet Documentation, so the unit of measure is defined product by product in administration guides, data sheets and ordering guides rather than in the contract itself.[1] This article summarises the whole estate; the articles listed under See also cover each construct in more depth.
Editions
Fortinet does not use a single edition ladder. Each product family is sold in its own commercial units:
| Product family | Commercial units the vendor names | Detail article |
|---|---|---|
| FortiGate hardware | Appliance, plus per-unit FortiGuard bundles (Enterprise Protection, Unified Threat Protection, Advanced Threat Protection, SD-WAN) or a la carte services, plus FortiCare | FortiGuard and FortiCare licensing |
| FortiGate-VM | vCPU bands VM01 to VMUL as normal (perpetual), v-series or s-series (subscription) licences; hourly on-demand in cloud marketplaces | FortiGate-VM licensing |
| FortiFlex | Daily points per entitlement, prepaid (Enterprise) or postpaid (MSSP) | FortiFlex and FortiPoints |
| FortiClient | VPN/ZTNA, EPP/ATP and Managed tiers per endpoint, on FortiClient Cloud or on-premises EMS | FortiClient, FortiManager and FortiAnalyzer licensing |
| FortiManager | Hardware, VM subscription, VM perpetual and FortiManager Cloud, by managed devices/VDOMs | same |
| FortiAnalyzer | Hardware, VM subscription, VM perpetual (GB/day of logs) and FortiAnalyzer Cloud (per device or GB/day) | same |
| FortiSASE | Standard, Advanced and Comprehensive remote-user subscriptions by user band | this article |
For FortiGate, Fortinet presents three curated FortiGuard bundles: the Enterprise (ENT) bundle for comprehensive attack surface security, the UTP bundle for web and network defence, and the ATP bundle as a first line of defence, with individual services also available a la carte.[3] All bundles include FortiCare Premium 24x7x365 technical support.[3] FortiCare itself is sold as Premium (24x7 support for each product) and Elite (higher SLAs and extended end of support), and FortiCare Essentials offers web-based support only for price-sensitive deployments.[4] The FortiGuard ordering guide limits Essentials to desktop models.[3]
FortiSASE remote-user subscriptions are sold in Standard, Advanced and Comprehensive tiers by user band (50 to 499, 500 to 1,999, 2,000 to 9,999 and 10,000 or more users), and each user can use up to three devices, agent-based or proxy-based.[5]
Metrics
The vendor metrics recorded in the catalog are:
- Product unit (per device) for FortiGate hardware and the FortiCare and FortiGuard Service Contracts attached to it. The Service Terms state that each unit of Product requires its own Service Contract.[2]
- FortiGate-VM vCPU and Virtual domain (VDOM) for virtual firewalls; licences are based on the number of CPUs only.[6]
- FortiClient endpoint for FortiClient managed by EMS or FortiClient Cloud.[7]
- FortiManager managed device/VDOM and Administrative domain (ADOM) for FortiManager.[8]
- FortiAnalyzer GB/Day of Logs and FortiAnalyzer Cloud logging device for FortiAnalyzer.[9]
- FortiSASE user.[5]
- FortiFlex Point and FortiPoint for the points-based programs.[10][11]
Counting / floors
Use rights and restrictions
The EULA licence is non-transferable (except as its transfer and open-source sections allow), non-exclusive and revocable, and use is solely for the End User’s internal business purposes unless Fortinet agrees otherwise in writing (rule).[1] Section 2 prohibits, among other things, renting or making the Software available to third parties except as permitted for Channel Partners, disclosing benchmark results, and using the Software on a device not owned and controlled by the End User (rule).[1] The Service Terms define a Customer as a buyer “for internal business purposes and not for further sale nor for providing chargeable services to third parties” (rule).[2] Organisations that deliver managed services on Fortinet products therefore need a partner agreement or the FortiFlex MSSP program rather than end-user licences.[11]
Fortinet’s licence, warranty and support are available only for Products bought directly from Fortinet or from an authorised Channel Partner, and other Products may be blocked from registration (rule).[1] Transfer of a Product unit to a third party is also a ground for terminating its Service Contracts.[2]
One contract per unit
Service Contracts apply to a single unit of Product or Support Portal account. Using a contract on a different unit is a material breach that ends the contract without refund and makes additional fees due at Fortinet’s then-current list price (rule).[2] FortiGuard updates are provided only for the Product covered by a FortiGuard Service Contract (rule).[2] The main exception is the single FortiGuard licence for active-passive HA pairs of FortiGate 40F to 100F models bought with the HA SKU, registered to a virtual serial number (rule).[12]
Registration, start dates and renewals
Service Contracts are fixed-term and do not auto-renew (rule).[2] The Service Contract Activation and Grace Period Policy starts unregistered contracts automatically: hardware-attached contracts 90 days after shipment (60 days for the United States and Canada), and non-hardware-attached contracts, including VM subscriptions, client software, SaaS and points-based licences, after 60 days (rule, rule).[13] Products bought without any Service Contract must still be registered to receive licence, RMA and warranty coverage (rule).[2]
A renewal starts on the day after the previous contract expired. If it is registered more than 180 days after expiry, its start date is set to 180 days before registration (rule).[2] The FortiOS documentation describes the same principle as FortiGuard services being “designed to be continuous”, with any lapse requiring coverage back to the contract expiration date.[14]
Expiry
A FortiGate keeps working as a firewall when FortiGuard licences expire, but signature databases stop updating and real-time services such as category-based web and DNS filtering stop, with web and DNS traffic dropped by default (rule).[14] From FortiOS 7.4.9 and 7.6.4, a FortiGate with an invalid Firmware & General Updates licence schedules a required upgrade to the latest patch of its minor version that can be postponed but not cancelled (rule).[15] FortiClient EMS gives ten days after expiry before it becomes read-only and stops registering new endpoints (rule).[16]
Audit
Fortinet reserves the right to audit use of its Hardware, Software and Services to verify compliance with the licence quantities purchased and other contractual terms, and the End User agrees to cooperate with a reasonable audit (rule).[1] The EULA sets no notice period, frequency or cost allocation. Commentary: several Fortinet metrics are enforced technically by the licence itself (a FortiGate-VM uses only its licensed vCPUs, EMS refuses registrations beyond its licence, FortiFlex meters consumption daily), so compliance questions tend to concern contracts attached to the wrong unit, products bought outside the authorised channel, managed-service use under end-user terms, and lapsed renewals. For the general practice see Software license audit.
Virtualization & partitioning
Fortinet does not license virtual firewalls by host processor. A FortiGate-VM is licensed by vCPU band; it keeps running on a larger instance, but only the licensed number of vCPUs process traffic and management (rule).[6] FortiGate-VM v-series and s-series include no VDOMs by default and VDOM addition licences are stacked separately (rule).[6] On the management side, FortiManager counts each VDOM of a VDOM-enabled FortiGate as one device licence, but does not count the secondary unit of an HA pair or FortiAP, FortiSwitch and FortiExtender devices (rule).[8] For the general concepts see Virtualization and partitioning.
Cloud / BYOL
On public clouds a FortiGate-VM is either bring-your-own-licence (BYOL), bought from resellers as a perpetual normal or v-series licence or an annual s-series subscription, or on-demand, billed hourly through the marketplace listing.[17] The two models are not interchangeable, and the licence type is fixed for the lifetime of the VM (rule).[17][18] A FortiGate-VM subscribed through a cloud marketplace comes with the UTP bundle.[19] FortiManager Cloud and FortiAnalyzer Cloud are subscriptions: FortiManager Cloud by the number of managed devices, and FortiAnalyzer Cloud either per logging FortiGate or FortiWeb or by shared GB/day capacity.[8][9]
Programs
- FortiGuard Security Bundles and FortiCare Support Services are the per-unit subscription and support layers for FortiGate. See FortiGuard and FortiCare licensing.
- FortiFlex Enterprise (prepaid) and FortiFlex MSSP (postpaid) meter VMs, hardware services, SaaS and endpoint entitlements in daily points. The MSSP program requires a minimum annual consumption commitment of 50,000 points.[11] See FortiFlex and FortiPoints.
- FortiPoints is a points currency that can be converted into FortiFlex points at volume-tiered rates.[11]
- The Enterprise Agreement Program is an account-based service providing multiple Service Contracts through prior agreement; Fortinet registers its contracts automatically with a communicated effective date (rule).[2]
- Co-term quotations align the end dates of new and existing services so that all components renew together.[3]
Evaluations and trials
Evaluation Software is licensed only for testing and not for production use, and unless the entitlement says otherwise it is limited to 60 days (rule).[2] Product free trials carry their own limits: FortiClient EMS allows three endpoints and three Chromebooks, and FortiManager-VM and FortiAnalyzer-VM trials include no services or support and are limited to one active trial per product and account (rule, rule).[20][8]
Out of scope
This article does not cover hardware specifications, the Fortinet Product Life Cycle Policy (published on the login-protected support portal), pricing, or the detailed licensing of FortiEDR, FortiSIEM, FortiWeb, FortiMail, FortiNAC, FortiAuthenticator, FortiToken or FortiSASE branch add-ons. Lacework FortiCNAPP has its own terms of service on the Fortinet legal page and is not covered.