The FortiGate 121G is the storage-equipped model of Fortinet's 120G series, built for distributed
enterprise sites and SD-WAN deployments that need real-world threat protection throughput, not just headline
numbers. The SP5 ASIC delivers 39 Gbps of raw firewall throughput and 2.8 Gbps of full threat protection
from a single 1RU appliance with 16 built-in GE switch ports, 8 GE SFP slots, 4 x 10GE SFP+ FortiLink
uplinks, and 480 GB of onboard SSD for local logging and SD-WAN analytics. Firewalls.com is a Fortinet
Expert partner with same-day shipping and certified engineers ready to configure your 121G before it ships.
Expert Pre-Sales AdviceCertified reps reply in 1 hour.
Config & Managed ServicesSkip the setup. We'll do it.
POs · Tax-Exempt · Net 30Welcomed for Corp, Edu, & Gov.
Same-Day ShippingOrder by 3pm EST, ships today.
Specifications
FortiGate 121G at a Glance
Performance
Firewall throughput of 39 Gbps (1518-byte UDP). IPS throughput of 5.3 Gbps. NGFW throughput of 3.1
Gbps. Full threat protection throughput of 2.8 Gbps with firewall, IPS, application control, and malware
protection all active. SSL inspection throughput of 3 Gbps. Application control throughput of 6.7 Gbps.
Firewall latency of 3.17 microseconds.
Interfaces
16 hardware-accelerated GE RJ45 switch ports. 8 GE SFP slots. 4 x 10GE SFP+ FortiLink slots,
reconfigurable as standard ports. 1 dedicated GE RJ45 management port. 1 dedicated GE RJ45 HA port. 1
USB port. 1 RJ45 console port. Bluetooth Low Energy (BLE) for out-of-band management. TPM (Trusted
Platform Module) included.
Capacity and VPN
3 million concurrent TCP sessions. 140,000 new sessions per second. 10,000 firewall policies. 2,000
gateway-to-gateway IPsec VPN tunnels. 16,000 client-to-gateway IPsec tunnels. 35 Gbps IPsec VPN
throughput (512-byte, AES256-SHA256). 1.5 Gbps SSL-VPN throughput. Up to 500 concurrent SSL-VPN users in
tunnel mode. 5,000 FortiTokens supported.
Hardware and Deployment
1RU rack-mount form factor, 1.73 x 17 x 10 inches. SP5 custom ASIC hardware acceleration (121G only
over 120G: 480 GB onboard SSD included). Dual built-in, non-hot-swappable AC power supplies for 1+1
redundancy. 43W average power draw. Side-to-back airflow. Active-Active and Active-Passive high
availability clustering. Supports up to 32 FortiSwitches and 128 FortiAPs.
Not sure which 120G model fits your environment?
The FortiGate 121G is the storage-equipped version of the 120G. If you need local log retention and
SD-WAN analytics without a separate FortiAnalyzer, the 121G is the answer. For larger session counts or
higher threat throughput, step up to the 200G series. Our engineers will help you size it right.
The hardware is nearly identical. The key difference is onboard storage. The 121G
ships with a 480 GB SSD, which the 120G does not include. That storage enables local log retention,
SD-WAN analytics, and reporting without requiring a separate FortiAnalyzer appliance at the site. Both
models share the same port configuration, SP5 ASIC, throughput specs, and FortiOS feature set. If
local storage matters for your deployment, the 121G is the right pick.
The SP5 is Fortinet's latest Security Processing Unit, combining a RISC-based CPU
with a proprietary content and network processor on a single chip. It accelerates firewall, VPN, and
deep packet inspection natively in silicon, which is why the 121G can reach 39 Gbps of raw firewall
throughput and 2.8 Gbps of full threat protection without relying on general-purpose CPUs. You get
enterprise-grade inspection performance from a 1RU branch appliance without paying for a much larger
chassis.
For most branch and distributed enterprise deployments, the UTP (Unified Threat
Protection) bundle is the right starting point. It covers IPS, application control, web and DNS
filtering, antivirus, and antispam, plus FortiCare Premium support. Organizations with stricter
compliance needs or zero-day exposure often step up to the Enterprise Protection bundle, which adds
inline sandbox, CASB, DLP, and OT security services. Our engineers can walk you through which bundle
maps to your requirements before you buy.
Yes. SD-WAN is built into FortiOS and included at no additional license cost. The
121G supports application-aware path selection, WAN SLA monitoring, cloud on-ramp, automated failover
across multiple ISP links, and full SD-WAN analytics stored locally on the 480 GB SSD. The 4 x 10GE
SFP+ uplinks and 16 built-in switch ports give you the flexibility to run active WAN aggregation and
access-layer switching from the same appliance.
Yes. The FortiLink protocol lets you manage FortiSwitch and FortiAP devices directly
from the FortiGate dashboard with no separate controller hardware needed. The 121G supports up to 32
FortiSwitches and up to 128 FortiAPs (64 in tunnel mode) from a single management interface. That
makes it a natural SD-Branch anchor for campus, distributed retail, or multi-site healthcare
environments where you want unified wired, wireless, and security management in one appliance.
Have questions about sizing a FortiGate 121G?
Tell us your user count, your WAN configuration, and whether you need local log retention. A Fortinet
Expert-certified engineer at Firewalls.com will get back to you within one business hour with a
recommendation and a quote tailored to your environment.
