Which FortiGate Firewall for a Small UAE Office? Sizing by Headcount & Bandwidth

The right Fortinet firewall for a small UAE office is the one whose SSL-inspected throughput still exceeds your internet line after you switch every security feature on. Most small offices in Dubai and Abu Dhabi now sit on du or Etisalat (e&) business fibre at anywhere from 100 Mbps to 1 Gbps, and a firewall that was fine on a 50 Mbps line becomes the bottleneck the day the ISP upgrades you. This guide walks through the FortiGate 40F, 60F, 70F, 90F and 100F classes by headcount, bandwidth and feature load, so you can size once and not revisit it for five years.

Quick reference: FortiGate sizing for small UAE offices

• Up to 15 users, 100–200 Mbps fibre: FortiGate 40F class. Enough for a small trading office, clinic reception or a two-desk branch of a larger firm.
• 15–40 users, 200–500 Mbps: FortiGate 60F or 70F class. The everyday small-office box for law firms, consultancies and showrooms with a server or NAS on site.
• 40–80 users, 500 Mbps–1 Gbps: FortiGate 90F or 100F class. Needed when full SSL inspection and IPS run on a gigabit line, or when several VLANs and a guest Wi-Fi network hang off it.
• Licence choice: FortiCare only for basic support and firmware; Unified Threat Protection (UTP) for web filtering, antivirus, IPS and application control; Advanced Threat Protection (ATP) where sandboxing matters.
• Budget band: hardware plus a first-year UTP bundle typically runs from the low thousands of AED for a 40F class to the low tens of thousands for a 100F class; quote on request.

Start with headcount, then correct for what those people actually do

Fortinet publishes a recommended user count for each model, but the number that matters is concurrent sessions. A 20-person accounting practice running Microsoft 365, a cloud ERP and Teams calls generates far fewer sessions than a 20-person real estate office where every agent has fifteen browser tabs, WhatsApp Web and a CRM open. As a rule of thumb, allow 300–500 sessions per knowledge worker at peak, and add a flat allowance for printers, IP phones, CCTV recorders and access control panels, which keep connections open all day. The FortiGate 40F class is comfortable to roughly 150,000 concurrent sessions, the 60F and 70F to around 700,000, and the 90F and 100F class to well over a million, so headcount alone rarely exhausts a modern FortiGate; it is the security features that do.

Match SSL inspection throughput to your fibre line

This is where most small-office sizing goes wrong. The headline firewall throughput on a datasheet (10 Gbps on a 100F class, for example) describes plain packet forwarding. The moment you enable deep SSL inspection so that web filtering and antivirus can see inside HTTPS traffic, which is now well over 90 percent of office traffic, the useful number drops sharply. Broadly, the 40F class inspects SSL at a few hundred Mbps, the 60F and 70F class at roughly 700 Mbps to 1 Gbps, and the 90F and 100F class at around 1 Gbps and above. If your du or Etisalat contract is 500 Mbps and you plan to run IPS, application control and SSL inspection together, a 60F class unit will be near its ceiling; a 70F or 90F class gives headroom. On a 1 Gbps line with full inspection, budget for a 100F class from the start rather than trying to tune a smaller unit.

SD-WAN for branches and backup lines

Every FortiGate includes SD-WAN in the base firmware at no extra licence cost, which is one reason the brand dominates UAE branch deployments. In practice this means you can bring in a primary fibre line from one provider and a 4G/5G or second fibre line from another, and the FortiGate steers Teams and Zoom over the lower-latency path while bulk downloads take the cheaper one. For a company with a head office in Dubai and a branch in Abu Dhabi, Sharjah or Ras Al Khaimah, a pair of 40F or 60F class units at the branches and a 100F class at head office, linked by IPsec VPN with SD-WAN overlays, is a common and cost-effective design. Ensure the branch units have enough WAN ports; the 40F class has fewer physical interfaces, while the 60F, 70F and above offer more flexibility for dual WAN plus dedicated DMZ ports. If you already manage other network gear, our routers and networking range covers the switches and access points that sit behind the firewall.

FortiCare vs UTP vs ATP: choosing the licence bundle

A FortiGate ships with a hardware warranty, but the security services are subscriptions and they change the price more than the hardware does. FortiCare alone gives you firmware updates and technical support, which is fine if the box is only doing routing, VPN and SD-WAN behind another security layer. The Unified Threat Protection bundle adds FortiGuard antivirus, IPS, web and DNS filtering, application control and antispam, and is the right default for a standalone small office. Advanced Threat Protection swaps in cloud sandboxing for unknown files, which banks, exchange houses and firms handling client financial data in the DIFC or ADGM tend to require. Bundles are sold in one, three and five-year terms; a three-year term usually lands the best per-year cost, and it aligns the renewal with a sensible hardware refresh cycle. Ask for the licence term to be quoted alongside the unit so you are comparing like with like; browse the current Fortinet collection for the model classes covered here.

When SonicWall or Ubiquiti fits better

Fortinet is not the only sensible answer. A SonicWall TZ series unit is a strong alternative when the office already runs SonicWall elsewhere or when the reseller support relationship is the deciding factor; the licensing model is similar, and the price bands overlap closely with the FortiGate 40F to 70F classes. Ubiquiti UniFi gateways make sense for offices that are primarily a Wi-Fi and switching estate, where the priority is a single dashboard and a low recurring cost, and where a full UTM feature set is not a compliance requirement; a cafe chain or a small design studio is a typical fit. If you need certified IPS, granular SSL inspection or a documented security posture for an audit, stay with Fortinet or SonicWall. Either way, plan for a UPS on the firewall and the fibre ONT, because a firewall reboot after a power blip drops every VPN and voice call; our guide to UPS power protection for offices and branch sites covers sizing for exactly this.

A worked example: 30-person Dubai consultancy

Take a 30-person consultancy in Business Bay on a 500 Mbps Etisalat business fibre line with a 4G backup. Staff use Microsoft 365, a cloud CRM and Teams; there is one on-premise file server and a guest Wi-Fi network for visitors. Session load is moderate, but the partners want full web filtering and SSL inspection to satisfy a client's vendor security questionnaire. A FortiGate 70F class with a three-year UTP bundle covers the inspected throughput with roughly 40 percent headroom, has enough ports for dual WAN plus a separate guest VLAN, and leaves room to add a second office over SD-WAN later. A 60F class would work today but would need replacing if the line went to 1 Gbps; a 100F class would be over-specified for the headcount. This is the kind of trade-off Procure.ae talks through daily with UAE offices when they replace a consumer router or an end-of-life firewall.

FAQ

How many users can a FortiGate 60F handle?

Fortinet positions the 60F class for roughly 25 to 50 users in a typical office. The practical limit depends more on SSL inspection load and internet speed than on headcount.

Do I need a UTP licence or is FortiCare enough?

If the FortiGate is your only security layer, choose UTP so that antivirus, IPS and web filtering are active. FortiCare alone suits routing and VPN-only deployments behind another firewall.

Can a FortiGate use two internet lines in the UAE?

Yes. SD-WAN is included in the base firmware, so a du fibre line and an Etisalat or 5G backup can be load-balanced or failed over without an extra licence.

Is Fortinet better than SonicWall for a small office?

Both are capable. Fortinet generally leads on SD-WAN and throughput per dirham; SonicWall is a good choice where existing skills or support relationships favour it.

Need help choosing between a FortiGate 40F, 60F, 70F, 90F or 100F class for your office? Get a quote from Procure.ae with your headcount and fibre speed, or browse the Fortinet firewall collection now.