How to choose a used FortiGate firewall (without getting burned)

Used enterprise firewalls are one of the best deals in homelab and small-office hardware. A FortiGate 100F that retailed for €4,000 can be had for €400–600 on the secondary market. But unlike a used switch or server, a firewall has pitfalls specific to the platform that can turn a bargain into a headache. This guide focuses on FortiGate because Fortinet dominates the SMB/branch market — which means the widest used supply — but most principles transfer to other NGFW vendors.

Why FortiGate specifically

FortiGate runs FortiOS, a mature, well-documented OS with a strong CLI, solid VPN (IPsec + SSL), IPS, web filtering, SD-WAN, and ZTNA features. Even old models (6.0-era hardware) run a recent enough FortiOS to be genuinely useful. The management UI is clean, the CLI is learnable, and there's a large community behind it.

The catch: Fortinet's subscription model means some features (IPS signatures, web filter categories, AV databases) are tied to a license. Hardware without an active license still works great as a stateful firewall and VPN concentrator — the signatures just stop updating. For homelab and many SMB use cases, that's acceptable.

What to check before buying

1. Hardware generation and throughput

FortiGate model numbers encode rough throughput:

• FortiGate 40F / 60F: ~1 Gbps firewall throughput — fine for fiber ≤1 Gbps and a small team
• FortiGate 80E / 100E / 100F: 2–10 Gbps — suitable for mid-size offices, remote-access VPN hubs, or a demanding homelab VLAN setup
• FortiGate 200E / 300E / 400F: 20–40 Gbps — branch aggregation or small datacenter edge

The "E" suffix = 6.x-era hardware (NP6/SP3 ASICs). The "F" suffix = 7.x-era (NP7/SOC4). Both are fully supported as of FortiOS 7.4.

Also check the number of physical interfaces. Some models have SFP+ ports that are useful for direct fiber uplinks or inter-zone 10G links; verify they match your cabling.

2. License status

Run or ask the seller to run:

get system status

Look for License Status: Valid or Expired. An expired license means:

• Stateful firewall ✅
• IPsec/SSL VPN ✅
• VLAN, routing, NAT ✅
• IPS signatures ❌ (frozen at expiry date)
• Web filter categories ❌
• FortiGuard DNS filtering ❌

For a homelab or budget office, unlicensed is often fine. For a production environment that needs up-to-date threat intelligence, budget for a license renewal or buy a unit that still has active FortiCare.

3. FortiOS version and upgrade path

Fortinet's firmware lifecycle is strict:

• Check Fortinet's product lifecycle page for EoS dates
• FortiGate 80E and older are approaching or past EoS — fine for air-gapped or homelab, a risk for internet-facing production
• From the CLI: get system status shows the current version

The good news: FortiOS upgrades between major versions (e.g. 6.4 → 7.0 → 7.2) are straightforward via the GUI, and Fortinet publishes upgrade path tools to avoid skipping versions.

4. Factory reset status

Always ask: "Has this been factory-reset?" A unit that still has a previous org's config is usable but requires extra care:

• Previous VPN credentials could be cached
• Custom certificates may still be present
• If you get a unit without the admin password, you CAN reset it via the console port and a BIOS interrupt — but you need a RJ45-to-DB9 console cable or a USB console adapter

The console reset procedure is documented in Fortinet's knowledge base and takes about 5 minutes. It's not a dealbreaker, but confirm before buying whether the seller has done it.

5. PSU and accessories

Mid-range FortiGates (200E+) use redundant PSUs in some configurations. Check:

• Is both/the PSU included?
• Any rack ears?
• Console cable? (3rd-party USB console cables work fine — CP210x chip)

Which model for which use case?

For pure homelab VLAN segmentation without active IPS, a FortiGate 60E running FortiOS 7.2 is the sweet spot: cheap, well-documented, 5 physical interfaces, capable CLI.

Configuration tips after buying

1. Factory reset first: execute factoryreset in the CLI, even if the seller says it's clean.
2. Update firmware before touching production traffic. Download directly from support.fortinet.com (free, needs a (free) account).
3. Disable FortiGuard reachability checks if you're running unlicensed — the unit will log repeated license check failures otherwise. Under System > FortiGuard, disable services you're not using.
4. Use policy-based NAT + security zones from day one — trying to retrofit zones later is painful.
5. Enable logging to memory or a syslog server (e.g. Graylog, Loki). Local disk logging on small FortiGates is limited and fills fast.

Where to find tested units

Auctions (eBay, Marktplaats) are hit-or-miss: units sometimes arrive still linked to a previous MSP's FortiManager, or with burned PSUs. Specialist resellers that test, reset, and warrant used enterprise gear are worth the small price premium — if you're in Europe and want reset, tested FortiGates with a warranty, IT and Office maintains a rotating stock of used firewalls from major brands.

What's your homelab firewall setup?

Running FortiGate, pfSense, OPNsense, or something else? Any surprising finds from the used market — good or bad? Drop a comment below.