FortiGate 90G Review: Size for Inspection and Plan the VPN Migration

A capable branch firewall needs a defined workload

Cartennas would shortlist the 90G for a branch that needs more than basic internet routing and already has, or intends to develop, FortiOS operating capability. Its appeal is the combination of high-speed interfaces, security policy and WAN functions in a compact platform. That combination is useful when one team owns the entire traffic path.

The hardware cannot choose the organization's inspection policy. Decrypting selected business traffic, maintaining exceptions for incompatible applications and reviewing security events are operating tasks. A purchase made solely to replace an old chassis can leave those tasks undefined even when the new appliance has considerable processing headroom.

The throughput rows answer different questions

Fortinet publishes 28Gbps basic firewall throughput for larger UDP packets, alongside 2.2Gbps threat protection and 2.6Gbps SSL inspection. These are different manufacturer tests. The threat-protection test enables multiple security functions; the SSL-inspection test uses an HTTPS workload. They are neither additive nor interchangeable.

A branch carrying 2Gbps of traffic that must receive intensive inspection should not be approved by comparing its circuit with the 28Gbps row. Even a closer-looking security figure is a shortlist input rather than guaranteed operating capacity. Traffic composition, new-session demand, cipher choices and the enabled policy can change the work the appliance performs.

For procurement, specify the workload that would make the purchase succeed: the traffic requiring decryption, simultaneous VPN use, important application latency and expected growth. A measured result for that policy is more valuable than a large margin against an unrelated headline figure.

Port flexibility does not remove topology limits

The published interface layout includes eight Gigabit RJ45 ports and two 10GbE shared-media pairs. The copper and optical choices in a shared pair represent alternative media for the same interface. Counting every physical connector as a simultaneously available high-speed port would produce the wrong design.

For a branch, those high-speed connections can support a faster WAN handoff or an aggregate path toward the LAN. The exact allocation matters when two circuits, an internal trunk and an HA design compete for interfaces. The useful bill of materials includes the selected optics or copper media and the configuration they support.

An older SSL-VPN specification can mislead a new buyer

Fortinet's product matrix retains an SSL-VPN performance entry with a firmware qualification for the 90G. Its migration guidance also states that SSL-VPN tunnel mode must be replaced before upgrading to FortiOS 7.6.3 or later. A historical throughput result does not establish that the same remote-access service exists on the intended software.

The practical purchase includes a remote-access migration plan. Authentication, client operating systems, application access and the networks from which staff connect all need to work on the replacement design. Keeping an obsolete firmware release simply to preserve an old feature is not a sound long-term purchasing assumption.

Cartennas would therefore separate the hardware decision from the VPN transition. The 90G can remain a suitable appliance while a particular legacy access method is unsuitable. That distinction prevents a software compatibility problem from appearing unexpectedly on the replacement night.

Operator reports show why release context matters

A 90G discussion included owners reporting stable operation on FortiOS 7.2.10 and 7.4.5, including a deployment using ADVPN and BGP. Other participants were evaluating how remote access and authentication affected their release choice. The discussion began with a different model's memory problems, which should not be transferred to the 90G.

These reports support a narrower conclusion than universal reliability: real deployments can work well, while the software branch and enabled features remain material. They do not justify selecting those historical builds today. The relevant evidence is the current supported release for the exact model and the behavior of the site's intended configuration.

The operating cost includes logs and subscriptions

The 91G is the storage-equipped sibling. That distinction matters when local logging is part of the design; the base 90G should not be purchased under the assumption that every family capability is included. An external logging destination also needs capacity, retention and someone responsible for reviewing it.

Security-service and support choices should be assessed over the intended service period. Cartennas would compare a complete operational configuration with alternatives, including the labor required for updates and policy changes. A low chassis price is useful only when the organization can keep the purchased protection functioning.