A firewall refresh can look straightforward until the appliance reaches site and the design constraints become clear. In a FortiGate 70G vs 90G decision, the right answer is rarely just the model with the higher throughput figure. It comes down to the internet service, user count, branch connectivity, switching requirements, security inspection profile and the capacity needed over the appliance’s working life.
Both platforms suit organisations that want enterprise-grade Fortinet protection in a compact form factor. Each can provide next-generation firewall controls, secure SD-WAN, VPN connectivity and centrally managed security services. The meaningful difference is how much headroom, interface flexibility and operational resilience your site requires.
FortiGate 70G vs 90G at a glance
The FortiGate 70G is well suited to small offices, retail locations, professional services firms and standard branches where the network is relatively simple. It is a practical choice when the site has moderate user demand, a conventional broadband or NBN connection, a limited number of connected network devices and no immediate need for a large switching footprint.
The FortiGate 90G is the stronger option when a site has more users, greater traffic demand or a more complex network edge. It is typically the better fit for a growing branch, a busy headquarters environment, a site with multiple WAN services, or a location where the firewall will carry substantial VPN, inspection and segmentation workloads.
That does not make the 90G automatically better value. Oversizing a firewall can tie up budget that would deliver more practical risk reduction elsewhere, such as endpoint protection, secure wireless, backup connectivity or a properly scoped FortiGuard subscription. The aim is to select enough capacity for the design, not simply the biggest desktop appliance available.
Start with real traffic, not headline throughput
Firewall data sheets list several performance measurements, and they should not be treated as interchangeable. Firewall throughput, IPS throughput, NGFW throughput and threat protection throughput each measure different processing profiles. A site that only routes internet traffic places a different load on an appliance than one inspecting encrypted web traffic, applying application controls, preventing intrusions and filtering content for every user.
For most business deployments, the most relevant figures are those closest to the intended security policy. If SSL/TLS inspection, IPS, web filtering, application control and malware protection will be enabled together, use the threat protection and NGFW performance ratings as planning references. Then allow capacity for busy periods rather than designing around average utilisation.
The 70G can be an efficient choice for a modest office with a well-defined security policy. The 90G provides more margin where sustained traffic levels are higher or where the firewall must support a greater number of concurrent sessions. That margin matters at sites using cloud applications heavily, transferring large files, running voice services or supporting a regular remote workforce.
A faster NBN or fibre service is also a reason to look carefully at the 90G. There is little commercial benefit in purchasing high-bandwidth connectivity if enabled security services prevent the firewall from using it effectively. Conversely, if the site’s WAN service is the limiting factor, paying for capacity that cannot be used may not be justified.
Encrypted traffic changes the sizing conversation
Most business traffic is encrypted. Without SSL/TLS inspection, a firewall has reduced visibility into web-based threats and undesirable application activity. With inspection enabled, the appliance has more work to do.
This is where a seemingly similar pair of appliances can separate in day-to-day experience. If the organisation intends to inspect a high proportion of outbound traffic, apply detailed security profiles and retain room for future internet upgrades, the 90G deserves serious consideration. If policy exclusions, privacy requirements or lower traffic volumes mean limited inspection, a correctly configured 70G may be entirely appropriate.
Inspection policy must also be designed carefully. Financial services, healthcare, legal practices and other regulated environments may need exclusions for specific categories of traffic or services. Performance is one consideration; privacy, compliance and operational continuity are equally important.
Ports and WAN design can decide the outcome
Interface requirements are often more decisive than raw performance. Before selecting either model, map the physical design: internet services, LAN uplinks, switch connections, wireless access points, voice equipment, management access and any handoff to an existing router or carrier device.
The 90G is generally the more flexible candidate for sites that need a broader interface mix or expect to connect more local infrastructure directly. This can reduce the need for additional hardware in a small deployment, although a firewall should not be used as a substitute for a properly designed access switch where multiple endpoints and PoE are required.
Review the exact appliance variant and current Fortinet data sheet before ordering. Port types, copper and fibre options, high-speed interfaces and PoE capability vary by model and bundle. A small omission here can create avoidable cost later, particularly where a site needs fibre handoff, multi-gig switching or powered access points and phones.
Dual WAN is about resilience, not just speed
Both platforms can support secure SD-WAN designs, but the quality of the outcome depends on the services connected to them. A primary fibre or business NBN connection paired with 4G, 5G or a second fixed service can keep key applications available during an outage.
The 70G is a sensible choice for a smaller branch with simple failover requirements. The 90G is better placed where more links, more application-aware routing rules or more demanding site-to-site connectivity are expected. For either model, test failover using the applications that matter, including cloud phone systems, payment terminals, VPN access and business-critical SaaS platforms.
VPN, segmentation and branch growth
A firewall can be sized correctly for internet traffic and still struggle once its broader role becomes clear. Site-to-site VPNs, remote-access VPN users, network segmentation, guest wireless, CCTV, building systems and cloud connectivity all add demands on the security architecture.
The 70G suits a location with a straightforward LAN and a manageable number of tunnels. It can provide secure connections to head office, cloud resources and authorised remote users while maintaining consistent FortiGate policy controls.
The 90G is a stronger long-term choice when the site will become a communications hub, support a larger remote workforce or run numerous VPN tunnels. It also makes more sense where departments, devices or services need separate security zones. Segmentation is not only an enterprise concern. Separating staff devices, guest Wi-Fi, payment systems, cameras and operational technology can limit the impact of a compromised endpoint.
If the business plans to standardise multiple sites on Fortinet, consider how the selected appliance fits the wider estate. Consistent policy templates, central visibility and repeatable branch designs can reduce administration and make incident response more efficient. Selecting the same model everywhere is not always necessary, but using a consistent design approach is valuable.
Licensing is part of the firewall decision
Hardware alone does not deliver the full security outcome. FortiGuard subscriptions determine which security services are available, while FortiCare provides vendor support options. The most suitable package depends on the organisation’s risk profile, internal skills and support expectations.
For many Australian businesses, a bundle that includes the required security services and support is more predictable than purchasing the appliance first and addressing subscriptions later. It also helps avoid a common procurement mistake: comparing hardware prices without accounting for the protection, support coverage and renewal position required for production use.
The 70G may create a lower initial cost, but value should be assessed across the anticipated lifecycle. If the site is likely to outgrow its capacity, interfaces or VPN requirements within two or three years, the 90G can be the more cost-effective decision. If growth is uncertain and the 70G meets documented requirements with adequate headroom, it can preserve budget without compromising design integrity.
A practical selection approach
Choose the FortiGate 70G when the site is small to medium in scale, its WAN bandwidth and inspected traffic levels are moderate, the physical interface design is uncomplicated, and its expected growth is controlled. It is particularly compelling for standard branches that need credible security, SD-WAN and VPN capability without paying for capacity they will not use.
Choose the FortiGate 90G when higher internet speeds, heavier security inspection, more users, more VPN activity or wider connectivity requirements are part of the picture. It is also the safer choice where the firewall will remain in service through planned expansion, additional cloud adoption or a move towards stronger network segmentation.
The decision should be validated against a short design worksheet: current and planned WAN speeds, peak user numbers, critical applications, security profiles, VPN tunnels, interface requirements, failover services and expected growth over the subscription term. That process turns a product comparison into a supportable procurement decision.
FortiSecure Store can help align genuine Fortinet hardware, licensing and certified deployment guidance to those requirements, without forcing a larger model where it adds no practical value. The best firewall is the one that protects the organisation at full policy strength, supports continuity when a service fails and leaves enough capacity for the business you are building towards.