FortiGate-VM
The same FortiOS on your hypervisor or in your cloud account, licensed by vCPU
- Licence range
- 1 – unlimited vCPU
- Licensing
- BYOL or on-demand
- FortiOS
- Identical to hardware
FortiGate-VM runs the identical FortiOS image as the hardware appliances, licensed by vCPU count from one core to unlimited. The same licence can generally be moved between supported platforms, and the feature set is the appliance feature set — nothing is withheld from the virtual edition.
Where it fits — and where it stops fitting
The honest caveat is that a VM has no NP7 or CP10 ASICs. Everything the hardware offloads to silicon runs on general-purpose CPU here, so throughput per vCPU is far below an equivalently-priced appliance. Virtual is the right answer for cloud workloads, lab and DR environments, and elastic capacity. It is usually the wrong answer for a high-throughput physical perimeter, and we will tell you so rather than sell you the licence.
Highlights
- Seven licence tiers from 1 vCPU to unlimited
- Same FortiOS image and feature set as the hardware
- BYOL licences are portable between supported platforms
- Managed alongside physical FortiGates in FortiManager
Typical deployments
- Firewalling inside a public cloud VPC or VNet
- Lab, staging and disaster-recovery environments
- Elastic capacity that would be wasteful as fixed hardware
What to work out first
FortiGate-VM runs the identical FortiOS image as the hardware, licensed by vCPU count rather than by chassis. Licences run from VM01 up to VM32 and an unlimited-vCPU tier, and the same licence can generally be moved between supported platforms.
Supported platforms are broad: VMware vSphere, Citrix Xen, Xen, KVM, Microsoft Hyper-V and Nutanix AHV on-premises, and AWS, Azure, Oracle OCI, Google Cloud and Alibaba Cloud in public cloud — the public clouds available both BYOL and on-demand.
The honest caveat: a VM has no NP7 or CP10 ASICs. Everything the hardware offloads to silicon is done on general-purpose CPU here, so throughput per vCPU is far below an equivalently-priced appliance. Virtual is the right answer for cloud, for lab and for elastic capacity — not usually for a high-throughput physical perimeter.
Questions worth answering before you order
BYOL or on-demand?
BYOL is materially cheaper for steady-state workloads and is portable between platforms. On-demand via a cloud marketplace suits burst and short-lived environments. We can quote either; for anything running more than a few months, BYOL almost always wins.
How many vCPUs?
The licence tier caps vCPU count, and FortiGate-VM will not use cores beyond the licence. Size the licence to the instance, not the other way round — an over-provisioned instance on a VM02 licence wastes the cores.
Do you need cloud-native instead?
If you want a managed service rather than an instance to patch and scale yourself, FortiGate CNF is the cloud-native alternative in AWS and Azure. It removes the appliance-management burden entirely.
How will it be managed?
Virtual estates sprawl faster than physical ones. FortiManager handles VM and hardware in one policy hierarchy, which is usually the deciding factor once you pass a handful of instances.
What this includes
Fortinet publishes no throughput table for this product — it is licensed per user, endpoint, workload or account. What follows is capability and sizing, not benchmarks.
Licence tiers
The licence caps vCPU count and FortiGate-VM will not use cores beyond it, so the licence is sized to the instance rather than the other way round. An over-provisioned instance on a small licence simply wastes the extra cores.
| FG-VM01 | 1 vCPU |
|---|---|
| FG-VM02 | 2 vCPU |
| FG-VM04 | 4 vCPU |
| FG-VM08 | 8 vCPU |
| FG-VM16 | 16 vCPU |
| FG-VM32 | 32 vCPU |
| FG-VM-UL | Unlimited vCPU |
Supported platforms
From the Fortinet Product Matrix virtual appliance support matrix. Public cloud platforms are available both BYOL and on-demand.
| On-premises hypervisors | VMware vSphere, Citrix Xen Server, Xen, KVM, Microsoft Hyper-V, Nutanix AHV |
|---|---|
| Public cloud | Amazon AWS, Microsoft Azure, Oracle OPC/OCI, Google GCP, Alibaba Aliyun |
| Also available as | FortiGate-VMX for VMware NSX, AzureStack and RackSpace (PAYG) |
Performance
Fortinet publishes no fixed throughput table for FortiGate-VM, because performance depends entirely on the host CPU, the hypervisor, the vNIC driver and which inspection features are enabled. Anyone quoting a firm Gbps figure against a VM licence alone is guessing. We size it from your host specification and your intended feature set.
| Throughput | Host-dependent — sized against your platform, not published |
|---|
Sources
- Fortinet Product Matrix (July 2026) — retrieved 2026-09-01
Reproduced from Fortinet published documentation and subject to change without notice. Where a figure is load-bearing for your design, ask us to confirm it in writing before you order — we will.