Fortinet FortiGate 91G FG-91G-BDL-809-36 Desktop Firewall, 3-Year Enterprise Protection
Overview
The Fortinet FortiGate 90G Series is the point in Fortinet's G-series range where 10 gigabit connectivity arrives in a desktop chassis rather than a rack unit. Fortinet positions the line for distributed enterprise sites and branch locations, and builds it on the Secure SD-WAN ASIC SP5, which combines a RISC-based CPU with Fortinet's own content and network processors so that application identification, IPsec and deep SSL inspection run in silicon rather than software. The FG-91G-BDL-809-36 is the stored variant of that pair, adding a 120 GB SSD to the otherwise closely matched FG-90G so that logging and reporting can stay on the appliance instead of depending on a collector. Resiliency comes from active-active, active-passive or clustered high availability formed over a data port, since this family has no dedicated HA interface, and power redundancy is optional: the appliance accepts up to two external DC power adapters and one is included. FortiOS forwards both IPv4 and IPv6 traffic; Fortinet does not publish a routing-protocol list for this appliance in the datasheet, which is why the specification table records the protocols as not published while stating IPv6 support. This part number is the bundled configuration: the same appliance supplied with a prepaid FortiGuard Enterprise Protection subscription and FortiCare Premium support for 3 years (36 months). The appliance itself is the FG-91G as sold on its own; what the bundle adds is the FortiGuard service entitlement and 24x7x365 support with one-hour response for critical issues.
Technical Details
The Fortinet FortiGate 91G FG-91G-BDL-809-36 is a desktop next-generation firewall with eight GE RJ45 ports and two 10/5/2.5/GE RJ45 or 10GE/GE SFP+/SFP shared-media pairs and a 120 GB onboard SSD, running FortiOS on the Secure SD-WAN ASIC SP5. Firewall throughput is 28 / 28 / 27.9 Gbps at 1518, 512 and 64-byte UDP, and threat protection throughput is 2.2 Gbps on the Enterprise Traffic Mix with logging enabled. IPsec VPN throughput is 25 Gbps at 512 bytes with AES256-SHA256, and SSL inspection throughput is 2.6 Gbps with IPS on average HTTPS. It holds 3 million concurrent TCP sessions and opens 124,000 new sessions per second. It operates from 0 to 40 degrees Celsius and is used at distributed enterprise sites for internet-edge protection, site-to-site VPN, and secure SD-WAN.
Best For
The FG-91G suits a distributed enterprise site or branch office that needs an internet edge with 10 gigabit uplink headroom and wants its logs held locally rather than shipped to a collector. Its eight GE access ports, two shared-media 10GE WAN ports and 3 million concurrent sessions fit a site terminating multiple WAN links and running site-to-site VPN back to headquarters, and its FortiSwitch and FortiAP controller capacity of 24 switches and 128 access points (64 in tunnel mode) covers an SD-Branch deployment from the same box. The 120 GB SSD is the reason to choose it over the FG-90G, which is otherwise closely matched. As a bundled part number it arrives with 3 years (36 months) of FortiGuard Enterprise Protection and FortiCare Premium support already attached, so the services do not need ordering separately.
Not suitable if:
- you already send all logging to FortiAnalyzer, FortiGate Cloud or a syslog collector, since the onboard storage would then go unused
- you need a dedicated high-availability interface, since HA on this family is formed over a data port
- you need more than two 10 gigabit ports, since the two shared-media WAN pairs are the only ports above 1 gigabit
- you need Power over Ethernet for cameras or access points, since this appliance provides none
- you need a rack-mount appliance with internal redundant supplies, since this is a desktop unit whose redundancy comes from a second external adapter
- you need a hardened appliance for a plant floor or outdoor cabinet, since this unit is rated only from 0 to 40 degrees Celsius
- you want a different subscription term or bundle tier, since this part number is fixed at 3 years of Enterprise Protection
FG-91G-BDL-809-36 Specifications
| Ports & Uplinks | |
|---|---|
| Fixed Interfaces | 8×1GbE RJ45, 2×10GbE RJ45/SFP+ shared-media combo |
| Max Port Speed | 10 GbE |
| Management & Console Ports | 1×RJ45 console, 1×USB |
| Performance & Scale | |
| Firewall Throughput | 28 / 28 / 27.9 Gbps (1518 / 512 / 64-byte UDP) |
| Threat Prevention Throughput | 2.2 Gbps (Enterprise Traffic Mix, logging enabled) |
| TLS/SSL Inspection Throughput | 2.6 Gbps (IPS, average HTTPS) |
| IPsec VPN Throughput | 25 Gbps (512-byte, AES256-SHA256) |
| Hardware & Memory | |
| Onboard Storage | 1×120 GB SSD |
| Power & Thermal | |
| Power Supply | 100-240V AC input (50/60 Hz); 12V DC, 3A rating; maximum current 115Vac/0.4A, 230Vac/0.2A |
| Redundant Power Supply | Optional |
| Maximum Power Consumption | 23.5 W (22.4 W average) |
| Physical & Environmental | |
| Operating System | FortiOS |
| Form Factor | Desktop |
| Dimensions (H x W x D) | 1.65 × 8.5 × 7.0 in (4.2 × 21.6 × 17.8 cm) |
| Weight | 2.47 lb (1.12 kg) |
| Operating Temperature | 32°F to 104°F (0°C to 40°C) |
| Software | |
| Central Management Platform | FortiManager, FortiGate Cloud |
| Routing Protocols & IPv6 | Routing protocols not published; IPv6 supported |
| Other | |
| Maximum Concurrent Sessions | 3,000,000 (TCP) |
| New Sessions per Second | 124,000 (TCP) |
| Maximum IPsec VPN Tunnels | 200 gateway-to-gateway, 2,500 client-to-gateway |
| High Availability | Active/Active, Active/Passive, Clustering |
FG-91G-BDL-809-36 Accessories
| Included Accessories | External DC Power Adapter (1 adapter included) |
| Optional Accessories | Rack Mount Tray (SP-RACKTRAY-02) Wall Mount Kit (SP-FG60F-MOUNT-20) Mounting Ear Brackets (SP-EAR-FG90G-10) AC Power Adaptor (SP-FG60E-PDC-5) Power Cable (SP-FG60CPCOR-XX) (sold separately) 1 GE SFP RJ45 Transceiver Module (FN-TRAN-GC) 1 GE SFP SX Transceiver Module (FN-TRAN-SX) 1 GE SFP LX Transceiver Module (FN-TRAN-LX) 1 GE SFP Transceiver Module, 90km Range (FR-TRAN-ZX) 10 GE SFP+ RJ45 Transceiver Module (FN-TRAN-SFP+GC) 10 GE SFP+ Transceiver Module, Short Range (FN-TRAN-SFP+SR) 10 GE SFP+ Transceiver Module, Long Range (FN-TRAN-SFP+LR) 10 GE SFP+ Transceiver Module, Extended Range (FN-TRAN-SFP+ER) 10 GE SFP+ Transceiver Module, 30km Long Range BiDi (FN-TRAN-SFP+BD27) (pairs with FN-TRAN-SFP+BD33) 10 GE SFP+ Transceiver Module, 30km Long Range BiDi (FN-TRAN-SFP+BD33) (pairs with FN-TRAN-SFP+BD27) 10 GE SFP+ Passive Direct Attach Cable, 1m (FN-CABLE-SFP+1) 10 GE SFP+ Passive Direct Attach Cable, 3m (FN-CABLE-SFP+3) 10 GE SFP+ Passive Direct Attach Cable, 5m (FN-CABLE-SFP+5) |
FAQ
Does the Fortinet FortiGate FG-91G-BDL-809-36 support PoE?
No. The FG-91G-BDL-809-36 provides no Power over Ethernet on any port, so cameras, access points and IP phones need their own power source or a PoE switch between them and the firewall. Its eight GE RJ45 ports and two 10/5/2.5/GE RJ45 or 10GE/GE SFP+/SFP shared-media pairs are all data-only. Input rating is 12V DC, 3A from an external adapter. Within the G series PoE appears on separate part numbers such as the 70G-POE models.
What does the 120 GB SSD in the FG-91G-BDL-809-36 do?
It gives the appliance local storage for logs and reports. A FortiGate without an internal drive must send its logging to FortiAnalyzer, FortiGate Cloud or a syslog collector, because there is nowhere on the box to keep it. The 120 GB SSD in the FG-91G-BDL-809-36 lets logs, reports and archived traffic data stay on the appliance, which matters at a site with no local collector or an unreliable link back to one. It is the main hardware difference from the FG-90G.
What transceivers do the shared-media ports on the FG-91G-BDL-809-36 use?
The FG-91G-BDL-809-36 has two shared-media pairs, each operating as either a 10/5/2.5/GE RJ45 port or a 10GE/GE SFP+/SFP slot. A pair is one port with two physical options rather than two ports, so the copper and pluggable sides cannot be used at once. The pluggable side takes Fortinet 1 GE SFP and 10 GE SFP+ transceiver modules, listed in the ordering information. Transceivers are sold separately.
How does high availability work on the FG-91G-BDL-809-36?
The FG-91G-BDL-809-36 supports Active-Active, Active-Passive and Clustering high-availability modes. This model has no dedicated HA port, so the heartbeat and synchronisation link runs over one of the data ports, which reduces the ports left for traffic. An HA pair should be two identical models on the same FortiOS build. Optional power redundancy is supported using up to two external DC power adapters; one adapter is included.
How many users can the FG-91G-BDL-809-36 handle?
Fortinet publishes no user count for the FG-91G-BDL-809-36, so size it on the capacity figures. The appliance holds 3 million concurrent TCP sessions and opens 124,000 new sessions per second, which is usually what runs out first at a branch site. Threat protection throughput is 2.2 Gbps and SSL inspection throughput is 2.6 Gbps; size against those, not the 28 / 28 / 27.9 Gbps firewall throughput. All values are stated as up to.
What is included in the FG-91G-BDL-809-36 bundle?
The FG-91G-BDL-809-36 is the appliance plus a prepaid FortiGuard Enterprise Protection subscription and FortiCare Premium support, both for a term of 3 years (36 months). Enterprise Protection covers IPS, anti-malware, URL, DNS and video filtering, anti-spam, AI-based inline malware prevention, data loss prevention (full features when running FortiOS 7.4.1, per Fortinet) and Attack Surface Security, along with the FortiConverter configuration-conversion service. OT Security and the SD-WAN and SASE services are not part of this bundle. FortiCare Premium provides 24x7x365 availability with one-hour response for critical issues and next-business-day response for everything else.
Does the FG-91G-BDL-809-36 require a subscription to operate?
No. Core firewall, routing and networking functions can continue to operate without an active FortiGuard subscription, while subscription-based security intelligence, updates and services require an active subscription. The FG-91G-BDL-809-36 ships with a prepaid FortiGuard Enterprise Protection subscription and FortiCare Premium support for 3 years (36 months); when that term ends, the FortiGuard intelligence and the support entitlement lapse and can be renewed.
Does the FG-91G-BDL-809-36 support SSL-VPN?
The datasheet lists SSL-VPN throughput of 1.4 Gbps and a recommended maximum of 200 concurrent SSL-VPN users in tunnel mode, with SSL-VPN support limited to FortiOS versions 7.0.12 through 7.0.15. On a FortiOS build outside that range, remote access on the FG-91G-BDL-809-36 means IPsec VPN, for which the datasheet publishes 25 Gbps of throughput and up to 2,500 client-to-gateway tunnels.
What condition is the FG-91G-BDL-809-36 sold in, and what warranty applies?
Network Devices Inc. supplies the FG-91G-BDL-809-36 new and factory sealed, in original Fortinet packaging with the standard accessories. It is covered by a one-year Network Devices Inc. warranty and a 30-day return window. Because the unit is new rather than renewed, it is eligible for Fortinet registration and for FortiCare and FortiGuard entitlements ordered against it, which is not always the case with refurbished stock. Orders ship from our New Jersey and Texas warehouses.
