Fortinet
Choosing a FortiGate model: 40F, 60F, 90G or 100F?
The model number goes up and so does the price. But which one does your office actually need?
Almost all web traffic is now encrypted. That is good for privacy and awkward for security: a firewall that cannot see inside an encrypted session cannot scan what is being downloaded through it. Malware delivery moved to HTTPS a long time ago for exactly this reason.
The firewall terminates the encrypted session, examines the content, then re-encrypts it towards the destination. To the client, the connection appears to be with the intended site — because the firewall presents a certificate that the client has been configured to trust.
That last part is the whole practical difficulty. Every device on the network has to trust the firewall's certificate authority, or it will show a warning on every single site.
FortiGate offers two modes and they are frequently confused.
Certificate inspection looks only at the unencrypted parts of the handshake — principally the destination hostname. It can block a whole site by category, but it cannot see the file being downloaded. It requires no certificate deployment and costs almost no performance.
Deep inspection decrypts the session and scans the content. This is what allows antivirus and IPS to work on HTTPS traffic — which is to say, on most traffic.
Many deployments we audit have certificate inspection enabled and everyone believes deep inspection is running. Antivirus is switched on, the dashboard looks healthy, and encrypted downloads are passing through unscanned.
Decryption and re-encryption are expensive. Enabling deep inspection can reduce usable throughput substantially — on smaller models, dramatically.
This is why appliance sizing has to assume inspection is on. Buying a model that meets your bandwidth only with inspection disabled means one of two outcomes: you leave inspection off and lose the protection you paid for, or you turn it on and the internet becomes noticeably slow. Both happen regularly.
Domain-joined Windows machines are straightforward: push the firewall's CA certificate through Group Policy and it is done in an afternoon.
The awkward cases are everything else — personal phones, contractor laptops, Macs, Linux servers, IoT devices, printers. A common and workable pattern is to apply deep inspection to the managed corporate VLAN and certificate inspection only on the guest and BYOD networks.
Some traffic must be excluded, and not for convenience — it will simply fail.
FortiGate ships with a reasonable default exclusion list. It is a starting point, not a finished configuration — you will add to it during the first weeks.
Enabling deep inspection network-wide on a Monday morning is how you generate a hundred support calls before lunch.
Also tell people it is happening. Where employee traffic is being decrypted, informing staff is both good practice and, under KVKK and the GDPR, generally a requirement rather than a courtesy.
Ask us about fortinet firewall installation, or request a free assessment directly.
The model number goes up and so does the price. But which one does your office actually need?
The appliance is a one-off purchase. The subscription is not — and what happens when it lapses surprises people.
A second line only helps if the switchover is automatic and fast. Otherwise it is an expensive standby nobody remembers to use.