FortiGate as an enterprise NGFW: security profiles, deployment roles, FortiOS 8.0, the end of SSL VPN tunnel mode and secure operating practices.
FortiGate is Fortinet's family of next-generation firewalls. Running the FortiOS operating system, it combines stateful filtering, application control, intrusion prevention, web filtering, VPN and SD-WAN in a single platform, available as hardware appliances, virtual machines and cloud images. In an enterprise, it typically protects the internet edge, the data centre, branch offices and, increasingly, the boundaries between internal network segments.
A traditional firewall decides based on addresses, ports and protocols. FortiGate adds context to those decisions: it identifies applications regardless of the port they use, links traffic to users through integration with directories and identity services, and inspects content with security profiles. The main profiles are antivirus, web filtering, DNS filtering, application control, intrusion prevention, file filtering and data loss prevention. Most of them rely on FortiGuard subscription services for signatures and reputation data, so licensing must be planned along with the hardware.
Many FortiGate models include dedicated security processors that offload tasks such as session handling and encryption. When sizing, compare the vendor's published throughput figures with the security features you actually intend to enable, since performance with full inspection differs significantly from basic firewall throughput.
The same platform can fill several roles:
Virtual domains (VDOMs) divide one physical unit into several independent logical firewalls, each with its own policies and administrators. High availability through the FortiGate Clustering Protocol provides active-passive or active-active redundancy. At scale, FortiManager centralises configuration and FortiAnalyzer centralises logs and reports.
Two branches are relevant in 2026. FortiOS 7.6 remains widely deployed, and Fortinet announced FortiOS 8.0 on 10 March 2026. According to Fortinet's announcement, the 8.0 release focuses on visibility and control over the use of generative AI applications, AI assistants for configuration, SASE extensions and quantum-resistant cryptography for management and VPN access.
Remote access has changed substantially, and administrators planning upgrades must take it into account:
Organisations still relying on SSL VPN tunnels should therefore migrate their users to IPsec dial-up VPN or to a ZTNA approach before upgrading. Always read the release notes and the supported upgrade path for your exact model and version.
The firewall itself is an exposed target. Recent years have seen several critical vulnerabilities in the SSL VPN and administration interfaces of many vendors, including Fortinet, some of them added to CISA's Known Exploited Vulnerabilities catalogue. Sound operating practices include:
A readable rule base is a security control in its own right. Use address and service objects with meaningful names, group rules by zone pair, place specific rules before general ones, and document the purpose of each rule in its comment field. Apply security profiles consistently rather than case by case, and decide deliberately where SSL deep inspection is required, taking privacy and legal constraints into account for categories such as banking or health sites.
Administering FortiGate well requires practice on real configurations. The FortiOS 7.6 Administrator – NSE 4 certification preparation covers policies, security profiles, VPN, SD-WAN, high availability and diagnostics. Teams managing many devices can continue with the FortiManager 7.6 Administrator – NSE 6 certification preparation and the FortiAnalyzer 7.6 Administrator certification preparation for centralised configuration and log management.
FortiGate brings firewalling, threat inspection, VPN and SD-WAN together on one platform that can serve at the edge, inside the network and across branches. Its effectiveness depends on correct sizing, a clean rule base and disciplined patching. With the move from SSL VPN to IPsec and the arrival of FortiOS 8.0, 2026 is a good time to review remote access designs and upgrade plans.