Fortinet license types define the security services, vendor support, and management/analytics layers that sit beside FortiGate hardware. Short answer: licenses generally fall into FortiCare (support), FortiGuard (threat intelligence and security services), bundles (multiple FortiGuard services in one SKU), identity/MFA (FortiToken and related), and when needed FortiManager / FortiAnalyzer licenses. An unlicensed or expired FortiGate may still route and firewall, but IPS, web filtering, and similar enterprise protections weaken or stop.
This guide is written for:
- IT and security managers reading SKUs on FortiGate quotes
- Procurement teams planning renewals and TCO
- Engineers who need license symmetry in HA and multi-appliance designs
- Decision makers budgeting protection + support + logging for ISO 27001 / KVKK
Quick Summary
- Fortinet licenses are separate from hardware price and often dominate multi-year TCO.
- FortiCare = vendor support and hardware/software support contract.
- FortiGuard = AV, IPS, web filtering, app control, and related cloud signature/intel services.
- Bundles pack multiple FortiGuard services into one SKU—validate the contents line by line.
- HA needs matching license levels on both units; unbalanced licenses create cluster warnings.
- Plan term (
1/3/5years) with the buying guide and model selection.
Table of Contents
- What Is a Fortinet License?
- Main License Families
- FortiCare Support Licenses
- FortiGuard Security Services
- How to Read Bundles
- FortiToken, Management, and Analytics Licenses
- HA and Multi-Appliance License Symmetry
- Renewals, TCO, and Common Mistakes
- Related Articles
- Checklist
- Next Step with LeonX
- Frequently Asked Questions
- Sources
Image: Wikimedia Commons - Fortinet FortiToken.
What Is a Fortinet License?
In the Fortinet ecosystem, “license” usually means two things at once: (1) FortiGuard subscriptions that keep security services current, and (2) FortiCare, the vendor support contract. Identity (FortiToken), central management (FortiManager), and logging/analytics (FortiAnalyzer) licenses may be added.
For product definition, see What Is a FortiGate Firewall?; for the company ecosystem, see What Is Fortinet?. This article focuses on license types and renewal/buying decisions.
Main License Families
| Family | What it does | If missing |
|---|---|---|
| FortiCare | Support, RMA, software support | Weak support/SLA |
| FortiGuard | Signatures/intel and security services | IPS/web filter weaken/stop |
| Bundle | Multiple FortiGuard services in one package | Manage many single SKUs |
| FortiToken / MFA | Two-factor authentication | Weak VPN/admin MFA |
| FortiManager | Central policy/management | Harder multi-device ops |
| FortiAnalyzer | Central logging/analytics | Weaker 5651/SIEM design |
SKU names vary by region and year; ask for a written list of which services each line covers.
FortiCare Support Licenses
FortiCare is Fortinet’s support and maintenance layer. It typically covers:
- Hardware RMA / replacement processes (by support level)
- Software/firmware support channels
- Support SLA classes (for example
8x5/24x7— confirm on the quote)
The appliance can run without FortiCare, but production outages make vendor support and replacement rights critical. Plan firmware windows using the FortiGate documentation library.
FortiGuard Security Services
FortiGuard is the cloud intelligence and subscription layer that keeps FortiGate security profiles current. Common service groups:
- Antivirus / Anti-Malware
- IPS (Intrusion Prevention)
- Web Filtering
- Application Control
- Antispam / email security services (environment-dependent)
- Sandbox / Advanced Threat components (bundle-dependent)
- Outbreak / botnet / IP reputation style intel services (bundle-dependent)
These services keep UTM/NGFW profiles “alive.” For how profiles affect packet/policy behavior, see How Does a Fortinet Firewall Work?. With SSL inspection, visibility rises and capacity can drop; see SSL Inspection.
How to Read Bundles
Quotes often show names like “UTM”, “Enterprise Protection”, or “ATP”. Names change with campaigns; contents matter more.
Bundle reading checklist:
- Which FortiGuard services are included?
- What term (
1/3/5years)? - Does the HA secondary unit get the same bundle?
- Is sandbox / advanced threat included or separate?
- Is renewal pricing estimated?
Pro Tip: Do not buy the cheapest bundle by name. Match the service set to your Threat Protection design. A package without web filter will not deliver content-control expectations.
Licensing does not make a model faster; sizing still depends on Threat Protection throughput. See How to Choose a FortiGate Model.
FortiToken, Management, and Analytics Licenses
FortiToken / MFA
SSL VPN and admin MFA may need FortiToken (or compatible MFA) as a separate line. For remote access design, see FortiGate SSL VPN Setup.
FortiManager
Used for central policy and firmware management across many FortiGate units. For fabric vision, see What Is Fortinet Security Fabric?.
FortiAnalyzer
Provides central logs, reports, and correlation. Often critical for 5651 / ISO 27001 evidence; see ISO 27001 Network Security: Firewall and VPN and FortiGate Access Control for ISO 27001.
VDOM / feature licenses
Some models tie virtual domains (VDOM) or extra features to separate licenses/limits. Ask for included VDOM count on the quote.
HA and Multi-Appliance License Symmetry
In Active-Passive HA, both units should have balanced license levels. Unbalanced licenses can:
- Raise cluster warnings
- Cause some security services to fail after failover
- Show up in audits as “backup unprotected”
For HA design, see FortiGate HA Installation. On purchase lines, do not forget FortiCare + FortiGuard for the second unit: Buying Guide.
Renewals, TCO, and Common Mistakes
Simple TCO view:
TCO ≈ Hardware + FortiCare (N years) + FortiGuard/bundle (N years) + (HA x2) + Analyzer/Manager + deployment
Common mistakes:
- Buying hardware only and deferring FortiGuard
- Taking
1year of license with no renewal budget - Different/missing packages on the HA secondary
- Signing a bundle without reading contents
- Separating Analyzer/log licensing from 5651 retention needs
For vendor comparison context, see Fortinet vs Palo Alto vs Cisco.
Related Articles
- FortiGate Firewall Buying Guide
- How to Choose a FortiGate Model
- What Is a FortiGate Firewall?
- What Is Fortinet and What Does It Do?
- FortiGate HA Installation
- What Is Fortinet Security Fabric?
- ISO 27001 Network Security: Firewall and VPN
Checklist
- FortiCare level and term written on the quote
- FortiGuard / bundle contents validated as a service list
- License term (
1/3/5years) aligned with budget - HA secondary license symmetry included if applicable
- MFA (FortiToken) need evaluated
- FortiAnalyzer / FortiManager need decided yes/no
- Renewal price estimate requested
- Bundle scope cross-checked against Threat Protection scenario
Next Step with LeonX
Fortinet licensing completes the model with protection and support. The wrong or incomplete package weakens both security and audit readiness. LeonX plans the right bundle, FortiCare, and logging design under Hardware and Software Solutions, especially Router, Switch and Firewall Deployment Service and Network Security, Firewall and IPS/IDS Solutions. For discovery, continue through Contact.
Frequently Asked Questions
What are the main Fortinet license types?
FortiCare (support), FortiGuard security services, bundles that combine those services, FortiToken/MFA, and when needed FortiManager/FortiAnalyzer. SKU names change by year—read the service list.
Does FortiGate work without licenses?
Basic routing/firewall often works. Enterprise IPS/web-filter style FortiGuard services will not deliver expected protection without active subscriptions.
What is the difference between FortiCare and FortiGuard?
FortiCare is vendor support/maintenance. FortiGuard is threat-signature and security-service subscriptions. Production usually needs both.
Do I need two licenses for HA?
In practice, plan FortiCare and FortiGuard/bundle for each physical unit. Levels should be symmetric.
Is a 3-year package better than 1 year?
3 or 5 years improve unit cost and predictability; 1 year preserves cash flow but raises renewal risk. Compare both in the TCO table.
