|
|
|
Member's Message >
Benchmarking the Fortinet FortiGate 60F: Speed, Se
Benchmarking the Fortinet FortiGate 60F: Speed, Se
Page:
1
Shazwan
20 posts
Mar 26, 2026
11:41 PM
|
The Fortinet FortiGate 60F is a compact, purpose-built security appliance aimed at branch offices, small and medium-sized businesses (SMBs), and distributed enterprises that need enterprise-grade protection without a large footprint. In this benchmarking-focused review we analyze raw throughput, inspection performance, VPN and session handling, and the practical value of the 60F when running realistic branch workloads. Our goal is to provide actionable guidance for sizing, tuning, and deploying the 60F so it delivers the best balance of speed, security, and total cost of ownership.
Why benchmark the FortiGate 60F?
Benchmarks translate vendor specifications into real-world expectations. Branch offices typically operate in the hundreds of megabits per second range, rely heavily on encrypted traffic to SaaS providers, and require low-latency connectivity for VoIP, remote desktop, and cloud applications. Simply accepting raw firewall numbers without measuring SSL/TLS inspection, IPS, antivirus, and VPN impacts can lead to under-provisioned deployments. Benchmarking the 60F helps administrators understand how the device performs under the combined load of modern protection stacks and whether its Security Processing Unit (SPU) acceleration materially improves user experience compared to software-based alternatives.
Key benchmarking objectives
Measure raw firewall forwarding versus inspected throughput (SSL inspection, IPS, AV).
Evaluate IPsec and SSL VPN throughput and latency under realistic patterns.
Assess concurrent session capacity and new-connection rate behavior.
Observe CPU and SPU utilization, thermal behavior, and management/logging impact.
Translate results to branch sizing and operational recommendations.
Test methodology and realistic scenarios
A reliable benchmark uses traffic that approximates what branch users generate—mixed HTTP/HTTPS, large file transfers (SMB), API/SaaS calls, DNS lookups, and VoIP. Important aspects of the methodology include:
Using modern TLS cipher suites and realistic certificate chains for SSL inspection tests.
Running both single large-flow and many-parallel small-flow tests to simulate streaming and web-browsing behavior.
Enabling IPS and AV with tuned signaturesets to reflect production configurations.
Measuring not only throughput but also latency, packet loss, and CPU/SPU utilization during sustained runs.
Including logging and management operations to observe any secondary impacts.
Laboratory results should be validated against at least one real-world pilot deployment to ensure the synthetic traffic matches operational patterns.
Throughput, inspection, and the SPU advantage
Fortinet’s SPU is the core differentiator for the 60F. In benchmark runs, the 60F demonstrates:
High raw firewall throughput sufficient for multi-hundred megabit internet links common in branch offices.
Strong IPsec and SSL VPN performance because cryptographic operations are offloaded to the SPU, reducing CPU contention.
Superior SSL/TLS inspection performance relative to many x86-based counterparts, maintaining usable throughput even when decrypting and scanning HTTPS flows.
Where software-based competitors show steep throughput degradation when enabling SSL inspection, the 60F’s SPU mitigates much of that loss by handling bulk cryptographic work in dedicated silicon. For branches where large portions of traffic are encrypted to cloud services—Office 365, Google Workspace, Salesforce—the SPU advantage translates into fewer user complaints and less need to bypass inspection.
Practical inspection observations
Enabling full SSL inspection reduces throughput compared to baseline numbers, but the drop is less severe than on non-accelerated devices.
Certificate validation checks (OCSP/CRL) and complex chain handling introduce additional latency that should be measured in your environment.
Selective inspection (whitelisting trusted SaaS providers) can improve user experience while preserving security for unknown or high-risk destinations.
IPS, antivirus, and concurrent feature loads
Intrusion Prevention and antivirus scanning are CPU- and I/O-intensive. Benchmarks consistently show that:
IPS tuned to relevant categories provides solid inline blocking with a moderate throughput impact; removing irrelevant signature categories improves performance.
AV scanning of large file streams is typically the heaviest load; offloading suspect files to cloud sandboxing reduces local strain but has licensing and latency trade-offs.
When IPS, AV, and SSL inspection are enabled concurrently, throughput drops further—however, the SPU + optimized FortiOS threading keeps performance acceptable for typical branch link speeds.
Tuning is essential: disable noisy or irrelevant signatures, limit deep scanning to high-risk channels, and use exclusion lists for trusted internal transfers to reduce unnecessary processing.
VPN performance and session handling
Branch deployments demand dependable VPN throughput and predictable latency. The 60F’s SPU-accelerated crypto yields:
High IPsec and SSL VPN throughput for typical branch-to-datacenter and remote-user patterns.
Low latency under load that supports interactive applications such as VDI and VoIP.
Session handling tests indicate good concurrent session capacity for small appliances; however, extremely high concurrent counts or flash-connection bursts (many users opening many browser tabs simultaneously) can stress session tables. Plan session timeout configurations and monitor session usage to avoid exhaustion during peak events.
Management, logging, and offload considerations
Performance measurements must include management and logging overhead. Verbose local logging, packet captures, and detailed analytics increase CPU and I/O load. Best practices based on benchmarking include:
Centralize logging and analytics (FortiAnalyzer or FortiCloud) to offload storage and heavy reporting from the branch device.
Use FortiManager for consistent policy deployment and to reduce on-device configuration churn.
Employ cloud sandboxing for heavy-file analysis to keep branch appliances focused on inline inspection rather than long-duration file analysis.
Thermal and reliability observations
Compact branch hardware can face higher ambient temperatures. Sustained benchmarking runs should include thermals: CPU and SPU temperatures, intake/exhaust temps, and any evidence of thermal throttling. The 60F’s design is suitable for office closets, but plan rack or cabinet ventilation accordingly to prevent performance degradation in warm environments.
Cost, licensing, and value
Benchmarks should be contextualized against licensing realities. FortiGuard services (IPS, AV, web filtering, sandboxing) are subscription-based and materially affect both capabilities and appliance load (offloads vs. local processing). When evaluating value:
Compare the inspected throughput your branch requires against the 60F’s performance with the actual licensed feature set you will run.
Factor in central logging and sandboxing subscriptions that reduce on-appliance load.
Consider total cost of ownership: hardware cost, FortiGuard subscriptions, FortiCare support, and potential MSSP fees for managed branches.
For many SMBs, the 60F offers excellent price-performance because its SPU preserves throughput while providing enterprise-level protections that would otherwise require larger or multiple devices.
Conclusion
Benchmarking the Fortinet FortiGate 60F shows a device optimized for branch security: strong raw throughput, SPU-accelerated SSL inspection and VPN performance, and practical feature capacity for SMB and distributed-enterprise needs. The appliance shines when deployed with tuned policies, centralized logging, and appropriate offloads (sandboxing) to preserve local resources. When you align benchmarked inspected throughput with your branch requirements and budget for FortiGuard subscriptions, the FortiGate 60F delivers an attractive balance of speed, security, and operational value for edge deployments.
|
Post a Message
|
|
