Fortinet
FortiGate is Fortinet's core product, and SD-WAN comes built in with no separate licence. Add FortiSwitch and FortiAP and the whole network is managed from the FortiGate itself (Security Fabric). The company is US-based.
- Headquarters
- United States
- Positioning
- EntryMid-marketEnterprise
- Official website
- www.fortinet.com
Who it suits
Organizations with a Vientiane head office and provincial branches that want site-to-site VPN and ISP failover in one box.
Overview
Fortinet today
Fortinet is a US company headquartered in Sunnyvale, California. Its core product is the FortiGate firewall, built around FortiASIC chips that Fortinet designs itself, which is why even small units inspect traffic faster than their size suggests. Every model runs the same operating system, FortiOS. Version 8.0 shipped in April 2026, although most organizations still run 7.4 or 7.6.
How the product families fit together
- FortiGate ranges from small branch units (70G, 90G) through head-office models (120G, 200G) up to data center chassis, plus FortiGate-VM for VMware, Proxmox and public cloud. SD-WAN is part of FortiOS and needs no separate licence.
- FortiSwitch and FortiAP are managed from the FortiGate's own interface through FortiLink. This is the heart of the Security Fabric: every switch port and access point sits on the same screen as your firewall policy.
- FortiManager controls policy across many FortiGates, and FortiAnalyzer stores logs and produces reports.
- FortiClient and FortiEDR cover endpoints, FortiMail covers email, and FortiSASE protects staff working away from the office.
Licensing and changes worth knowing
A FortiGate is sold as hardware plus a 1, 3 or 5-year bundle such as ATP, UTP (Unified Threat Protection) or Enterprise Protection. The bundle combines FortiCare (support and RMA) with FortiGuard services (antivirus, IPS, web filtering). When it lapses, the box still passes traffic, but anything that depends on updates stops protecting you.
The change that catches most people out: from FortiOS 7.6.3 onwards, Fortinet removed SSL VPN tunnel mode and replaced it with IPsec VPN, which can run over TCP 443. Old settings are not migrated, so the remote-access VPN has to be rebuilt before the upgrade.
FortiGate fits almost any size, from a shop with ten PCs to a bank with branches in every province. It is strongest for organizations with a Vientiane head office and several branches that want site-to-site VPN and dual-ISP failover in a single box.
Strengths
- SD-WAN, site-to-site VPN and dual-ISP failover are built into FortiOS on every model with no extra licence, which suits organizations with provincial branches.
- FortiASIC chips let small units such as the 70G run IPS and antivirus together without slowing to a crawl, so small branches don't need oversized hardware.
- With FortiSwitch and FortiAP added, firewall, switching and Wi-Fi are managed from one screen, which saves a two- or three-person IT team a lot of time.
- Plenty of engineers in Thailand and Laos know FortiGate, and Fortinet's entry-level training is free online, so bringing a new admin up to speed is not hard.
Things to know before choosing
- FortiGuard and FortiCare bundles must be renewed. Without them the box keeps routing, but IPS, antivirus and web filtering stop updating and a failed unit won't be replaced.
- FortiOS has had serious vulnerabilities in its internet-facing VPN components that were exploited in real attacks. Someone has to watch the advisories and keep firmware current.
- The removal of SSL VPN tunnel mode in FortiOS 7.6.3 means planning a move to IPsec and re-deploying FortiClient to staff before you upgrade.
- There are many features and menus move between FortiOS versions. Careless setups, such as leaving the admin page reachable from the internet, are a common finding.
Using it in Laos
FortiGate is one of the firewalls we see most often in Lao organizations. Hardware and licences come in through distributors in Thailand. Small and mid-range models are usually in stock; larger units can take several weeks including customs.
What we see on sites:
- Power: desktop FortiGates run on an external adapter, and that adapter usually dies before the firewall when evening voltage sags or rainy-season lightning hit. Always put the unit on a UPS and keep one spare adapter.
- Internet: use SD-WAN with two ISPs that genuinely take different paths, not two packages from the same provider.
- Provincial branches: models with built-in Wi-Fi, or with a 4G/5G modem attached, help small offices that have no second fiber line.
- People: engineers who can set up a basic FortiGate are not hard to find in Vientiane. People with real FortiManager and FortiAnalyzer experience are fewer.
Sectors where it is common: banks and microfinance, mining companies, hotels, factories and multi-branch retail.
Compared with alternatives
Sophos Firewall is the better fit if you want the firewall and endpoint protection to work together and need an MDR team watching overnight. Palo Alto Networks suits banks and large enterprises with a dedicated security team that want fine-grained policy by application and user. For many small branches that only need simple VPN, WatchGuard is also a sensible choice. Pick FortiGate when you want SD-WAN, VPN and switch and Wi-Fi management in one box with good performance for the money.
Product lines
- FortiGate
- FortiSwitch
- FortiAP
- FortiAnalyzer
- FortiManager
- FortiClient
- FortiEDR
- FortiMail
- FortiSIEM
- FortiSASE
Solutions that use this brand
Next-Generation Firewall (NGFW)A firewall that knows which app and which user, with IPS, web filtering, HTTPS inspection and VPN, sized on real all-features-on…
SD-WAN for BranchesProvincial branches run two internet links at once. If one fails, the other takes over within seconds, and everything is…
Secure Remote Access (VPN/ZTNA)Staff and contractors reach internal systems from anywhere through VPN or ZTNA with MFA, seeing only what they need.
Zero Trust & Network Access Control (NAC)Check every user and device before it joins, with 802.1X and NAC. Plugging into a LAN port no longer means reaching the servers.
Endpoint Protection & EDREDR that watches behaviour, not just virus lists. It stops ransomware mid-run and cuts an infected PC off the network at once.
Email SecurityStop phishing, fake boss and fake supplier emails (BEC) and malicious attachments with filtering, SPF/DKIM/DMARC and sandboxing.
SOC & SIEM MonitoringFirewall, server and endpoint logs in one SIEM, with people watching the alerts and a clear plan for when something happens.
Enterprise LAN & SwitchingA core–access LAN with VLANs, redundant uplinks and enough PoE. One looped cable no longer takes down the whole building.
Enterprise Wi-FiWi-Fi 6/6E/7 with APs placed from real measurements. Works in a full meeting room, holds calls while you walk, secured with WPA3.
Industrial Networking (OT)Hardened switches that survive dust, heat and vibration, with ring redundancy and IT/OT separation for plants and mines.
Hotel Guest Wi-FiWi-Fi guests can join easily, strong in every room, each guest isolated, with your own login page and PMS link.
Network Monitoring (NMS)Every device, link and internet circuit on one screen, with alerts that reach IT before the first user calls.
Vulnerability Assessment & Penetration TestingScan and test systems, websites and networks to find weaknesses before someone else does, with a report ordered by what to fix…
Business Email & DomainDomains (.la, .com) registered in your company's name, and business email with SPF, DKIM and DMARC so mail reaches inboxes and…FAQ
If our FortiGate licence expires, will the internet stop working?
No. Firewalling, routing and VPN keep working. What stops is updates for IPS, antivirus and web filtering, plus your right to a replacement if the unit fails. The box stays up, but it no longer protects you from new threats.
Our staff use FortiClient SSL VPN. What happens when we upgrade FortiOS?
From FortiOS 7.6.3, SSL VPN tunnel mode is gone and the old settings are not carried over. Build an IPsec remote-access VPN first, test it with a few users, then upgrade. IPsec can be set to use TCP 443 if hotel or mobile networks block other ports.
Can we use FortiGate with another brand of switch, such as Cisco or Aruba?
Yes. VLANs, LACP and routing are standards every brand supports. What you lose is seeing and managing switch ports from the FortiGate screen. If your existing switches are healthy there is no need to replace them straight away.
Which bundle should we buy: ATP, UTP or Enterprise?
For most organizations UTP is enough: it covers IPS, antivirus, web filtering and DNS filtering. ATP suits branches on a tight budget that filter the web elsewhere. Enterprise adds risk and configuration assessment services and suits banks or organizations with heavy reporting needs.
All brand names and trademarks belong to their respective owners. Mention does not imply official partnership unless explicitly stated. Products are sourced through legitimate distribution channels.
Send us a floor plan or a few photos of the site
We’ll come back with a few questions, then a first design. The first consultation is free, in Lao, Thai or English, on WhatsApp or our Facebook page.