Two different things that are easily confused
Anyone purchasing a FortiGate for the first time will encounter two abbreviations that sound similar at first glance but address entirely different matters.
- FortiCare It is manufacturer support for the hardware itself, access to firmware updates, the option to replace a faulty unit and technical support directly from Fortinet.
- FortiGuard is the collective term for security services that actively protect the firewall in real time, current threat database, web filtering, gateway antivirus and intrusion prevention.
Without a valid FortiGuard license, the firewall continues to route traffic but stops recognising new threats. It behaves practically like an ordinary router from the start. our article on the difference between a router and a firewallThe security functions will remain installed in it; they will simply stop receiving current data.
What is included in the hardware price and what is paid annually
The device itself is acquired, purchased or leased, as a one-off. In contrast, FortiCare and FortiGuard licences are paid for repeatedly, typically annually or for several years in advance together with the hardware. Without an active licence the firewall continues to run, but it loses precisely that part of protection for which it was acquired.
Safety service packages
Fortinet offers FortiGuard services at several levels of protection scope, which build upon one another:
- The basic level covers gateway antivirus, intrusion prevention and web filtering: the core protection that makes sense to keep enabled practically at all times.
- A higher level adds deeper control of individual applications and protection against unknown threats, suspicious files are evaluated based on their behaviour in an isolated environment, not just according to known patterns.
- The highest level adds further features, such as monitoring data leaving the company and a deeper overview of connected devices.
Which package makes sense depends on what the business operates and what it is exposed to: a small company with one office usually does not need the highest level, whereas a company with multiple branches or sensitive data does. The specific features of individual levels are discussed in the article about UTM functions in practice.
Why licences are tied to specific equipment
FortiCare and FortiGuard are activated on specific hardware units based on their serial numbers, not on the company as such. Therefore, a licence cannot simply be transferred to another model if the company later switches to more powerful equipment, when hardware is replaced, a new licence must also be arranged, usually as part of the same delivery. This also has a practical advantage: the company knows exactly which specific device the licence belongs to and when it expires, without needing to maintain a separate list of subscriptions.
Fortinet typically offers licenses for one year or multiple years in advance under a single contract. The multi-year option is cost-effective where the company expects the hardware to serve for several years, aligning the license expiry with the planned end of the device's life cycle, rather than handling renewals annually.
What happens when a licence expires
The most common mistake is not choosing the wrong package, but forgetting to renew the licence. The firewall continues to function, so the problem is not immediately visible, however, security features gradually become outdated and the company may remain unaware until an incident occurs. Therefore, it pays to monitor the licence expiry date as carefully as, for example, insurance renewal.
How we handle this here
In FortiGate rentals via FortiPro, FortiCare and the selected FortiGuard bundle are always included in the monthly fee. You don't need to worry about renewals ourselves - we monitor license validity for you and before the contract ends, we assess whether it makes sense to continue with the same configuration or replace the hardware. How such a transition to a firewall looks in practice is described in our article. Firewall or just the router from your provider?