We supply, replace, upgrade and manage FortiGate firewalls. We size and source the hardware and FortiGuard licences, move the configuration across from older units, clean up rules and VPN access, keep FortiOS current and run the estate from FortiManager hosted in Australian data centres.
A replacement usually brings a rule clean-up with it, and a FortiOS upgrade often changes how staff connect remotely, so we plan the pieces together. Engagements range from one firewall at a single office to estates across many branches.
We size the replacement for the security work it will carry, supply the G-series hardware with FortiGuard and FortiCare licensing, check TradeUp eligibility and move the configuration across in a staged cutover. Hardware, licences and the work can be financed as a monthly payment.
How we replace a FortiGateA read-only review of rules, NAT, SSL inspection, FortiOS, VPN, IPS, administrator access and backups, ending in a ranked list of fixes, most urgent first. We then make the fixes through controlled change.
Inside the reviewWe plan the upgrade path, confirm the hardware can run the target release and patch against Fortinet PSIRT advisories, with a compromise check after each perimeter patch. Remote access moves off SSL VPN tunnel mode before FortiOS 7.6.3.
FortiOS upgradesWe close old staff and contractor VPN access, move remote access to IPsec VPN or ZTNA, add segmentation and redesign policy where the rule base has grown past tidying.
SASE and Zero TrustWe run the firewall from FortiManager: firmware cadence, rule hygiene, change control, log retention, alert review and FortiGuard renewals, with FortiAnalyzer and FortiAIOps alongside.
How we workA FortiGate keeps passing traffic long after its configuration, firmware or licensing has fallen behind. Select what you’re seeing to show what we’d do first.
Nothing selected yet.
The areas where exposure builds up, checked read-only while the firewall keeps running.
The findings come back in order of risk, so the urgent exposure is fixed first. The review sets out the fixes needed and shows whether the current hardware can keep meeting the requirement, and it runs alongside your IT team.
Many FortiGates have years left once they’re cleaned up. Others are past support, stuck on an unsupported FortiOS branch or short of capacity for the inspection load. Answer four questions to see which path fits, and check the dates for your model in our FortiGate lifecycle checker.
Where is the model in its hardware lifecycle?
Can it run a FortiOS release that’s still supported?
Does it carry IPS and SSL inspection at your traffic levels?
Do your SD-WAN, ZTNA and interface plans fit the model?
Clean up the configuration, bring FortiOS current and plan the replacement around its support dates.
Fix the exposure on the current unit, then time the replacement with its support dates, the FortiGuard renewal or a wider network project.
Plan the G-series replacement now, with TradeUp checked and a staged cutover booked.
The review answers the questions marked not sure, so the path is confirmed before anything is bought.
We supply the hardware and licences, move the configuration across and cut over after hours.
Sizing comes first. A datasheet leads with firewall throughput, but the figure that matters is threat protection throughput, with IPS, application control and malware protection switched on, and it drops again with SSL inspection. We size on that, at your traffic levels and with room to grow.
Fortinet TradeUp can reduce the cost of replacing eligible units, and we confirm eligibility by serial number before the order.
Inspection load, users, WAN links and growth set the model, measured on the current unit where there is one.
Hardware, FortiGuard and FortiCare licences come from us, with TradeUp eligibility confirmed and financing available for the hardware, licences and work.
FortiConverter moves much of the configuration across. We review what it produces, rebuild what doesn’t translate cleanly and clear out stale rules on the way.
The new FortiGate is built, loaded and tested before it goes on site, with a rollback plan to the old unit.
Production cutovers run after hours. We test traffic, VPNs, remote access and applications before the old unit is retired.
The new unit joins FortiManager with monitoring, backups and FortiOS patching in place, managed by us or handed to your team.
Select a model for its replacement and support date. Interfaces, performance and the services in use can change the target.
Hardware and FortiOS have separate lifecycles, and each model has a last FortiOS branch it can run. The 100E, 100EF and 101E stop at 7.2, which reached end of support on 30 September 2026, and the 60E, 61E, 80E, 81E and 90E stop at 7.4. Extended support for 7.2 to 31 March 2028 applies only to eligible devices on FortiCare Elite.
On 2 GB models, including some 60E, 80E and 90E units, newer releases remove or restrict proxy-based features, so we check the release notes for your model before an upgrade.
Fortinet removed SSL VPN tunnel mode in FortiOS 7.6.3, and the upgrade doesn’t carry tunnel-mode configuration across. If staff connect that way, remote access moves to IPsec VPN or ZTNA before the firewall goes to 7.6.3 or later. We build the new access, test it with a pilot group and move staff across, then upgrade.
On 2 GB models such as the 40F and 60F, SSL VPN goes entirely from FortiOS 7.6.0, and smaller G-series models don’t run SSL VPN, so a replacement moves remote access at cutover.
Current FortiOS
Remote access
Model
Supply, replacement, upgrades and remediation can each be delivered on their own, and managed firewall operation is a separate service. Each piece of work follows the same sequence, and a FortiGate we manage is held to the standard below.
The ACSC has issued alerts on exploited Fortinet vulnerabilities, so patching a perimeter device includes checking it wasn’t compromised before the patch went on.
Rules, NAT, VPN, admin access, FortiOS, FortiGuard, SSL inspection, IPS, logging, backups and change control.
Users, sites, applications, VPNs, published services and Microsoft 365 paths mapped against the configuration, so a fix doesn’t break something the business relies on.
Exposed services, known vulnerabilities, weak admin access, stale VPN accounts and unsupported firmware come before housekeeping.
Stale rules removed, scope tightened, SSL inspection staged in, IPS tuned, firmware updated, logging and admin access fixed, backups validated.
Where we run the FortiGate: rules reviewed on a schedule, firmware on a cadence, logs owned, changes documented, alerts triaged and renewals planned.
FortiGuard bundles carry the security services that run on the FortiGate. We match the bundle to the features the firewall actually runs and track renewal dates across the estate.
IPS, antivirus and the core threat services, for a firewall that doesn’t filter web traffic.
ATP plus web and DNS filtering and antispam. The usual choice for an internet edge.
UTP plus services such as inline CASB, DLP and attack surface rating, for environments that use them.
The firewall itself carries on. What changes is the protection around it.
Protection weakens as the signatures age, so we start renewal planning well before the end date.
Our engineers work on FortiGate policy, inspection, VPN, SD-WAN, FortiOS upgrades and FortiManager as day-to-day work.
Where a FortiGate is still supported, we check whether it can be hardened before recommending new hardware. A model past its support date moves straight to a replacement plan.
We run FortiManager in Australian data centres, with high availability where the environment needs it.
We source the hardware and licences, arrange financing where it suits, configure and deploy the FortiGate and manage it afterwards.
We take on FortiGates we didn’t install, starting with a review of the configuration, access, firmware, licensing and logging.
Firewall policy is designed with your SD-WAN, carrier links, Microsoft 365 paths and secure access, so a change in one doesn’t break another.
It brings more security functions into one platform. FortiGate runs next-generation firewall policy, application control, intrusion prevention, web filtering, SSL inspection, VPN and SD-WAN in FortiOS. What’s available depends on the model, the FortiOS release and the FortiGuard licence.
Yes. We supply FortiGate hardware with FortiGuard and FortiCare licensing, check TradeUp eligibility by serial number and can finance the hardware, licences and work as a monthly payment.
It depends on the model. The 60E maps to the 70G, the 61E to the 71G, the 80E and 90E to the 90G and the 100E to the 120G. The exact target also depends on the interfaces, performance and services in use, and our FortiGate lifecycle checker lists the replacement for each model.
Plan for it before the date. After End of Support, Fortinet is no longer obliged to support the hardware, and there’s no hardware replacement entitlement if the unit fails. A FortiGate at the main internet edge is worth replacing before then, while a spare or lab unit can carry on for longer.
The firewall keeps running with weaker protection. Traffic, firewall rules and VPNs carry on. IPS and antivirus run on the signatures already on the unit, with no new ones arriving. Cloud web and DNS filtering can stop, and by default browsing through a category web filter is blocked until renewal. Renewing before the end date avoids the gap.
FortiOS 7.6.3 removed tunnel mode. The upgrade to that release doesn’t keep tunnel-mode settings, so staff who connect that way need IPsec VPN or ZTNA in place first. We set up the new access, pilot it, move staff across and then upgrade the firewall.
Yes. We review the configuration, access, firmware, licensing, logging, VPNs and rule base first, then clean up what needs it and bring the FortiGate under our management.
No. The review is read-only and the firewall keeps running. Fixes that follow are scheduled around business hours and application dependencies, with changes to traffic or inspection tested, staged and ready to roll back.
For three or more FortiGates, usually yes. FortiManager keeps policy, objects and firmware consistent across sites and stages changes centrally. A single FortiGate runs well from its own interface.
Some, yes. Most web traffic is encrypted, so without inspection IPS and antivirus can’t see inside it. Blanket inspection breaks applications, so we inspect selectively, with a tested certificate rollout and exclusions for traffic that shouldn’t be decrypted.
No firewall does that on its own. FortiGate supports the network access restrictions and security controls used alongside an Essential Eight uplift. The eight mitigation strategies also need controls across endpoints, applications, identity, administration and backups.
Yes. We can run the FortiGates, take on specific projects or back your team with Fortinet engineering, while your team keeps the business context and day-to-day ownership.
Tell us which models you run, the FortiOS release they’re on and what’s coming up: an end-of-support date, a FortiGuard renewal, an upgrade or a change to remote access. We’ll work through hardening, upgrading or replacing them, and the cost of each.
We will be in touch to arrange a time.