FortiGate 40F
Five-port desktop NGFW with LTE variant — the long-serving branch workhorse
- Threat protection
- 600 Mbps
- Firewall throughput
- 5 Gbps
- IPsec VPN
- 4.4 Gbps
- Concurrent sessions
- 700,000
Front panel
- RJ45 copper
The 40F has been the default small-branch FortiGate for years. Five gigabit ports, 600 Mbps threat protection, 10 VDOMs, and a 3G4G variant that makes it a common choice where cellular failover is needed in the same box.
Still a sound choice where you need its 3G4G or WiFi variant. Where you do not, compare it hard against the 50G: the newer model delivers nearly double the threat protection and four times the SSL inspection throughput in the same footprint. Note also that the 40F carries no local storage and, on FortiOS 7.6.0 and later, loses SSL VPN because of its 2 GB of RAM.
Highlights
- 600 Mbps threat protection, 4.4 Gbps IPsec VPN
- 3G4G and WiFi variants for cellular or wireless branches
- 10 VDOMs for basic tenant or department separation
- No local storage — pair with FortiAnalyzer or FortiGate Cloud for logs
Typical deployments
- Branch offices needing built-in LTE failover
- Sites already standardised on the 40F where spares consistency matters
- IPsec spoke terminating back to a campus hub
The numbers, with their conditions
Every figure below is Fortinet's own, with the test conditions it was measured under.
Performance
Fortinet's published figures. Firewall throughput is measured on UDP with no inspection enabled — size your deployment on threat protection throughput instead, which is measured with firewall, IPS, application control and malware protection all running against an enterprise traffic mix.
| Firewall throughput (1518 / 512 / 64 byte UDP) | 5 / 5 / 5 Gbps |
|---|---|
| IPsec VPN throughput (512 byte)IPsec VPN performance test uses AES256-SHA256. | 4.4 Gbps |
| IPS throughput (enterprise mix)IPS, application control, NGFW and threat protection are measured with logging enabled. | 1 Gbps |
| NGFW throughput (enterprise mix)NGFW performance is measured with firewall, IPS and application control enabled, enterprise mix traffic. | 800 Mbps |
| Threat protection throughput (enterprise mix)Threat protection performance is measured with firewall, IPS, application control and malware protection enabled, enterprise mix traffic. | 600 Mbps |
| SSL inspection throughput (IPS, avg. HTTPS)SSL inspection performance values use an average of HTTPS sessions of different cipher suites. | 310 Mbps |
| Application control throughput (HTTP 64K) | 990 Mbps |
| Firewall latency | 2.97 µs |
Capacity
| Concurrent sessions | 700,000 |
|---|---|
| New sessions / second | 35,000 |
| Firewall policies | 2,000 |
| Max gateway-to-gateway IPsec tunnels | 200 |
| Max client-to-gateway IPsec tunnels | 250 |
| SSL VPN throughput | — |
| Concurrent SSL VPN users (recommended max, tunnel mode) | — |
| Virtual domains (default / max) | 10 / 10 |
Security Fabric capacity
How much of the rest of the Fabric this model manages directly, with no separate controller.
| Max managed FortiAPs (total / tunnel) | 16 / 8 |
|---|---|
| Max managed FortiSwitches | 8 |
| Max FortiTokens | 500 |
Hardware
| Interfaces | 5x GE RJ45 |
|---|---|
| Local storage | — |
| Power supplies | Single AC PS |
| Form factor | Desktop |
| Variants | WiFi, 3G4G |
Model-specific caveats
Fortinet conditions that apply to this model in particular. Worth reading before you order.
| Note 1 | Proxy features have limited support on this model — check the data sheet before relying on them. |
|---|---|
| Note 2 | SSL VPN is not supported on FortiOS 7.6.0 and above for models with 2 GB RAM. |
Sources
- Fortinet Product Matrix — FortiGate Network Security Platform (July 2026) — retrieved 2026-09-01
Reproduced from Fortinet published documentation and subject to change without notice. Where a figure is load-bearing for your design, ask us to confirm it in writing before you order — we will.
Buyers also compare
FortiGate 50G
The variant-rich branch model — WiFi, DSL, SFP, PoE and 5G in one family
FortiGate 30G
The smallest current-generation FortiGate — full FortiOS for a micro site
FortiGate 60F
Ten-port desktop NGFW — the most widely deployed FortiGate ever built