The hardware is identical except for onboard storage. The FortiGate 400G ships with no internal storage. The FortiGate 401G adds 960 GB of onboard SSD (two 480 GB drives) for local log retention, which means you can store and search logs directly on the appliance without a separate FortiAnalyzer. Every other spec, including throughput, interfaces, ASICs, and power supplies, is exactly the same between the two models.

Raw firewall throughput reaches 145 Gbps at 64-byte UDP. With security services active: IPS runs at 25 Gbps, NGFW (firewall plus IPS plus application control) runs at 14 Gbps, and full threat protection (adding malware inspection) runs at 13 Gbps. All of these figures include logging, which is how Fortinet publishes them in the official datasheet. The NP7 and CP10 ASICs provide the hardware acceleration that keeps performance high even with multiple inspection layers running at once.

The FortiGate 400G / 401G is sized for up to 5,000 users. It supports 28 million concurrent TCP sessions and 580,000 new sessions per second, so it handles environments with heavy traffic loads and large numbers of simultaneous connections without degrading. It also supports up to 5,000 concurrent SSL-VPN tunnel-mode users, 512 managed FortiAPs, and 96 FortiSwitches via FortiLink.

The Unified Threat Protection (UTP) bundle covers IPS, antivirus and botnet protection, URL and DNS filtering, video filtering, application control, and FortiCare Premium 24x7 support. The Enterprise Protection bundle adds AI-based inline malware prevention, data loss prevention, anti-spam, attack surface security for IoT devices, and FortiSOC as a service. Application control and inline CASB are included with any active FortiCare subscription at no extra charge. All bundles are available in 1, 3, and 5 year terms.

Yes. Secure SD-WAN and universal ZTNA are built into FortiOS and available on all FortiGate firewalls at no additional license cost. SD-WAN gives you WAN path selection, application steering, and quality-of-experience monitoring from the same interface you use to manage your security policy. ZTNA enforces per-session application access verification for both agent-based (FortiClient) and agentless proxy-portal access, covering users whether they are on your network or working remotely.

Yes. Our Fortinet Expert certified engineers offer a pre-ship configuration service that covers 25 or more components tuned to your environment, an analysis call before we touch the device, remote deployment assistance, and 7 calendar days of post-deployment support. The appliance arrives ready to plug in, not ready to spend a week figuring out. You can add configuration service to any hardware order during checkout or by contacting our team.