Fortinet FortiGate 3000F.
Hyperscale NGFW for large enterprise and data center.
The FortiGate 3000F series is built for large enterprises and service providers that run serious
throughput. Fortinet's proprietary NP7 and CP9 security processors deliver 397 Gbps of firewall throughput
and 33 Gbps of full threat protection in a 2 RU chassis. The 3000F and 3001F share the same performance
profile and port density. The 3001F adds 2 TB of onboard SSD for local log storage without a separate
FortiAnalyzer. Both ship as AC models, with DC-power variants available for carrier-grade data center
environments.
Expert Pre-Sales AdviceCertified reps reply in 1 hour.
Config & Managed ServicesSkip the setup. We'll do it.
POs · Tax-Exempt · Net 30Welcomed for Corp, Edu, & Gov.
Same-Day ShippingOrder by 3pm EST, ships today.
Specifications
FortiGate 3000F at a Glance
Performance
397 Gbps IPv4 firewall throughput (1518-byte UDP). 36 Gbps IPS throughput. 34 Gbps NGFW throughput. 33
Gbps threat protection throughput. All throughput figures are measured with logging enabled on an
enterprise traffic mix, so the numbers reflect real inspection workloads, not synthetic best-case runs.
Connectivity
6x 100GE QSFP28 / 40GE QSFP+ slots, each breakout-capable into 4x 25GE SFP28. 16x 25GE SFP28 / 10GE
SFP+ / GE SFP data ports including 2 dedicated HA slots. 16x multi-speed 10G/5G/2.5G/GE RJ45 data ports.
2x 10GE/GE RJ45 management ports on a separate management path, isolated from the data plane.
VPN Capacity
105 Gbps IPsec VPN throughput (AES256-SHA256, hardware-accelerated). 11 Gbps SSL VPN throughput. 40,000
gateway-to-gateway IPsec tunnels. 200,000 client-to-gateway IPsec tunnels. SSL VPN supports up to 30,000
concurrent remote users, making this series well-suited to large distributed workforces and SD-WAN
overlay architectures.
Capacity
70 million concurrent sessions standard, expandable to 230 million with a Hyperscale Firewall License.
500 virtual domains (VDOMs) for multi-tenant segmentation. Dual NP7 Network Processors and dual CP9
Content Processors provide hardware-accelerated VXLAN, DDoS protection, and elephant flow handling
without burdening the main CPU.
Not sure which 3000F configuration fits your stack?
The FG-3000F and FG-3001F deliver identical throughput and the same port complement. The 3001F adds 2 TB
of onboard SSD, which matters when local log retention or on-box FortiAnalyzer logging is part of your
design. Talk to one of our Fortinet Expert certified engineers and we will size the right model, bundle,
and support term before you order.
The FG-3000F and FG-3001F run on identical hardware and deliver the same throughput,
port density, and processor complement. The only hardware difference is onboard storage: the 3001F
ships with 2x 1 TB SSDs (2 TB usable) for local log retention, which removes the need for a dedicated
FortiAnalyzer in smaller deployments. The -DC suffix on either model indicates a direct-current power
supply for data center environments that distribute DC power.
Fortinet publishes 33 Gbps for threat protection throughput, which measures the
appliance running IPS, application control, and malware protection simultaneously on an enterprise
traffic mix with logging enabled. That is the number to plan around if you intend to run full
inspection. The 397 Gbps firewall throughput figure applies to a stateful firewall-only workload on
large packet sizes, which is a different and lighter workload than full NGFW.
Most commonly at the enterprise perimeter edge, at the data center core as a
segmentation device between internal zones, and in hybrid IT environments that need 100GE uplinks to
the network core. Service providers use the multi-tenant VDOM architecture to manage up to 500
isolated policy domains on a single chassis. The -DC models serve telecom and carrier environments
where DC power distribution is standard. Fortinet recommends this series for organizations running ISP
connections up to 11 Gbps and expecting 500 to 2,000 concurrent users on the NGFW.
Full NGFW capability requires a FortiGuard bundle that activates IPS, application
control, and URL filtering at a minimum. Fortinet sells two main bundles for this series: the Unified
Threat Protection (UTP) bundle, which covers IPS, antivirus, application control, URL filtering, and
antispam, and the Enterprise Protection bundle, which adds AI-based inline malware prevention, DNS
filtering, inline CASB, data loss prevention, attack surface security, and the FortiConverter
migration service. Both require a FortiCare support contract, which covers firmware access, technical
support, and hardware warranty.
Yes. Both the 3000F and 3001F include two dedicated HA interface slots (HA1 and HA2)
that are physically separate from the NP7 data path and management plane. Active-active and
active-passive HA modes are both supported via Fortinet's FortiGate Clustering Protocol (FGCP).
Redundant, hot-swap AC power supplies ship standard on both AC models, and the dual power design
covers the unit even during a supply failure without a planned maintenance window.
Need help sizing a FortiGate 3000F?
Give us your ISP speeds, expected concurrent user count, and whether you plan to run full threat
inspection or firewall-only. A certified Fortinet Expert engineer will match you to the right model and
bundle, and can bundle in configuration service so the appliance ships ready to install.
