A FortiGate homelab box isn’t a licensed FortiGate. The appliance you buy for NSE practice routes, filters, builds IPsec tunnels and runs SD-WAN with no subscription at all, but the security profiles stop learning the day you plug it in. That gap matters less than people think for certification practice, and more than they think for the last two features on the exam blueprint they care about.
The other surprise is memory. The FortiGate 40F, 60F and the newer 50G all fall into Fortinet’s 2 GB RAM class, so FortiOS strips proxy features from every one of them. This guide compares the three on what changes your practice, adds the free FortiGate-VM licence as the zero-cost option, and explains why the Palo Alto PA-410, the usual Palo Alto lab suggestion, did not make it. Amazon stock, listing condition and price bands below were checked on October 30, 2026 against Fortinet’s current datasheets.
Three FortiGates still sell new
All three picks are the appliance-only SKU with no FortiGuard bundle, sold new by BlueAlly on Amazon. That is the version you want for a lab. The bundle roughly doubles the price for signature updates you don’t need to pass a FortiOS admin exam.
| Award | Model | Why it wins | Price band (check live) |
|---|---|---|---|
| Best overall | FortiGate 50G | Newest SoC, fastest inspection of the three | about $560 |
| Best value | FortiGate 40F | Cheapest real FortiGate, 10 VDOMs | about $360 to $380 |
| Most ports | FortiGate 60F | Ten ports, two WANs, a DMZ | about $545 |
| Free option | FortiGate-VM evaluation | Runs on Proxmox or ESXi, no hardware | $0, heavily capped |
The 60F and the 50G cost about the same, which is the decision most readers actually face. You are choosing between port count and a newer chip, and the sections below show which one your practice plan needs.
How these boxes were picked
No FortiGate or Palo Alto appliance went through our lab for this guide, so every number here is from the vendor datasheet, not from our own bench. What was checked live, on October 30, 2026:
- Amazon listing, seller, condition and stock for each ASIN
- Throughput, ports, power and VDOM limits from Fortinet’s datasheet PDFs
- FortiOS feature removals on 2 GB RAM models from Fortinet’s docs
- What keeps working without FortiGuard, from Fortinet’s licence-expiration page
Anything listed as Renewed, or sold “No License” by a refurbisher, was excluded from the picks. The goal of the guide is a box you can register in your own FortiCloud account, and a used unit’s registration history is something you can’t see from a listing.
FortiGate 40F vs 50G vs 60F specs
Firewall throughput is the number Fortinet prints biggest, and it is the one that matters least in a homelab. Your WAN link caps it long before the box does. The rows that change a cert lab are the inspection numbers, the port count and the VDOM ceiling.
| Spec (datasheet) | FortiGate 40F | FortiGate 50G | FortiGate 60F |
|---|---|---|---|
| Chip | SoC4 | SP5 | SoC4 |
| Firewall (1518 B UDP) | 5 Gbps | 5 Gbps | 10 Gbps |
| IPS | 1 Gbps | 2.25 Gbps | 1.4 Gbps |
| NGFW | 800 Mbps | 1.25 Gbps | 1 Gbps |
| Threat protection | 600 Mbps | 1.1 Gbps | 700 Mbps |
| SSL inspection | 310 Mbps | 1.3 Gbps | 630 Mbps |
| IPsec VPN (512 B) | 4.4 Gbps | 4.5 Gbps | 6.5 Gbps |
| GE RJ45 ports | 5 | 5 | 10 |
| VDOMs (default / max) | 10 / 10 | 5 / 5 | 10 / 10 |
| Max FortiAPs | 16 | 16 | 64 |
| Power (avg / max) | 7.74 / 9.46 W | 8.3 / 8.9 W | 10.17 / 12.43 W |
| Cooling | Fanless | Fanless | Fanless |
Read the SSL inspection row first. The 50G inspects TLS at more than four times the 40F’s rate and roughly double the 60F’s, which is the only row where the generations differ by that much. The VDOM row runs the other way: the newer box allows half as many virtual domains, though five is still more than any single practice topology uses.
The licence decides what you can practise
Fortinet’s own documentation is blunt about this: the FortiGate still functions as a firewall when any or all FortiGuard licences are missing. What changes is the data behind the security profiles, and each one degrades differently.
- Policies, NAT, routing and IPsec: work normally
- IPS, antivirus and application control: scan with the last signatures loaded
- Static URL and domain filters: keep working
- Category web and DNS filtering: stop, and drop traffic by default
The fourth item catches people. Category filtering asks FortiGuard to rate every URL in real time, so with no licence the lookup fails and the default action blocks the request.
What happens when your lab exercise applies a web filter profile with category rules? The category lookup has nothing to answer it, so the profile denies requests even though your configuration is correct. Static URL filters are different: Fortinet’s licence-expiration page says they keep working without a licence.
Firmware is the other licence question. Fortinet’s support community states that firmware images are for products with a current FortiCare contract. A box that ships on an older FortiOS build can leave you practising on menus that do not match the course material. Check the build the day it arrives, and plan for a FortiCare contract if you need a newer one.
2 GB of RAM removes proxy features
Sales pages skip this part. Fortinet groups the 40F and 60F series as 2 GB RAM models, and the FortiOS 7.6.7 release notes name the 50G series alongside them. From FortiOS 7.4.4 onward these boxes drop a block of proxy features, and existing proxy-mode policies convert to flow mode on upgrade.
- proxy-based inspection mode (email protocols returned in 7.6.5)
- explicit and transparent web proxy
- ZTNA, WAF and ICAP
- inline CASB and WAN optimization
Later builds removed more. FortiOS 7.6.3 dropped the Security Rating and the Security Fabric topology pages on 2 GB devices, so the Fabric views a course shows you won’t appear on any of these boxes. The 40F and 60F datasheets also footnote that SSL VPN is not supported from 7.6.0, though that one doesn’t separate the boxes, because 7.6.3 replaced SSL VPN tunnel mode on every FortiGate model.
All three datasheets carry the same footnote on FortiGuard services: Content Disarm and Reconstruct, DNS and Video Filtering, and Inline CASB are gone on the 40F and 60F from 7.4.4, and are not available on the 30G and 50G series in any OS build. A newer chip does not buy back the proxy features.
If your study plan includes explicit proxy or ZTNA labs, none of these three boxes will run them. Fortinet’s 7.4.4 change note says FortiGate VMs keep the proxy features whatever their memory, though it recommends 4 GB, so the free VM below is the cheaper way to see those menus.
FortiGate 50G: best overall
The 50G is the box to buy new if you want one FortiGate that lasts through recertification. It is the G-series generation on Fortinet’s SP5 chip, and it leads the three on every inspection row in the datasheet.
For practice the headline is SSL inspection at 1.3 Gbps. Deep inspection is where the older boxes slow down, because every TLS session gets decrypted, scanned and re-encrypted on the box, so the 50G is the one that keeps a real household link usable while you experiment with inspection profiles. It is also a topic every FortiOS admin course spends time on. You also get a TPM and Bluetooth Low Energy for setup from the mobile app, neither of which the 40F or 60F has.
- Buy it for: SSL inspection labs, a long support runway
- Pass on it for: VDOM-heavy labs past five domains
- Watch for: only 2 reviews on the Amazon listing so far
With five ports you have one WAN, three LAN and a FortiLink port, which is tight once you add a FortiSwitch. Stock was down to 15 units when checked, at about $560 for the appliance-only FG-50G, so check the live price.
FortiGate 40F: cheapest real FortiGate
The 40F runs the same FortiOS GUI and CLI you meet on the exam, for about two thirds of the 50G’s price. For policies, NAT, static and dynamic routing, IPsec and SD-WAN rules, that is all you need. It also has the most reviews of the three on Amazon.
What do you give up? SSL inspection tops out at 310 Mbps, so a lab that inspects a gigabit download will show the 40F as the bottleneck. That is fine for learning the configuration, because the exam tests whether you can build the profile, not how fast it runs. It is less fine if you also run your home internet through the box with deep inspection on, since every family member’s traffic then shares that 310 Mbps ceiling.
- Buy it for: the lowest entry price, 10 VDOMs
- Pass on it for: inspecting fast WAN links
- Watch for: the oldest generation of the three
Before you buy, look up the 40F on Fortinet’s product life cycle page, because the F-series predates the 50G and its end-of-order date sets how long new FortiOS builds keep coming. The appliance-only FG-40F listing showed about $360 to $380 and 154 reviews.
FortiGate 60F: ten ports for topologies
The 60F is the box for people who build topologies rather than single policies. Ten GE ports give you two WANs for SD-WAN failover, a DMZ, five internal ports and two FortiLink ports, and it costs about what the 50G does.
Two physical WAN ports matter more than any throughput row for SD-WAN practice. Fortinet’s datasheet gives the 60F two WAN ports plus a DMZ, so an SD-WAN pair of uplinks leaves all five internal ports free for clients. The 40F and 50G datasheets list a single WAN port, so a second uplink on either box costs you one of the LAN or FortiLink ports.
- Buy it for: dual WAN plus DMZ without losing LAN ports
- Pass on it for: SSL inspection performance
- Watch for: third-party trackers list a 2027 end of sale
That last line comes from eol.network, which lists January 13, 2027 for end of sale and 2032 for end of support. Confirm it on Fortinet’s own life cycle page before you treat it as final. The appliance-only FG-60F was in stock at about $545 against a $695 list price.
FortiGate-VM costs nothing, with three of everything
Searches for “fortigate vm homelab” usually end at Fortinet’s permanent evaluation licence for FortiGate-VM. It doesn’t expire and runs on any private hypervisor, so a Proxmox node you already own becomes a FortiGate. The limits are tight:
- 1 vCPU and 2 GB of memory
- three interfaces, three firewall policies, three routes
- low encryption only, no FortiGuard, no FortiCare
- two VDOMs (root stays admin, one carries traffic)
- one free copy per FortiCloud account
Three policies end most exercises before the interesting part, and three interfaces mean WAN, LAN and one more. Use the VM to learn the GUI and CLI layout for free, then buy hardware when you need a fourth policy.
It is the same split we recommend for OPNsense: learn it as a VM on Proxmox first, then move to a dedicated box.
Why the PA-410 dropped off the list
The PA-410 was meant to be the Palo Alto comparison, but Amazon has no listing for it at all. The only new PA-400 series unit on Amazon is a PA-440 sold by a refurbisher with “[No License]” in the title, and a second listing for the same model is marked Renewed. Neither belongs in a guide about boxes you can register cleanly.
Palo Alto’s PA-400 datasheet rates the PA-410 at 1.4 Gbps firewall and 0.8 Gbps threat prevention with seven GE ports, and the PA-440 at 2.4 Gbps and 1.2 Gbps with eight. For a Palo Alto certification, the vendor’s certification page now lists tracks such as Network Security Professional and Next-Generation Firewall Engineer rather than PCNSA and PCNSE.
Buy PAN hardware from an authorized partner who can confirm the support licence transfers, or practise on a VM-Series evaluation. Our firewall books guide covers the Palo Alto study material.
What to check before buying a FortiGate
Most bad FortiGate purchases come from reading the listing title instead of the SKU. Check these on the listing and on the box when it arrives:
- Condition reads New, not Renewed
- Seller can sell a registrable unit
- SKU is appliance-only if you don’t want FortiGuard
- FortiOS build on arrival matches your course
- Life cycle dates on Fortinet’s support portal
The console port matters too. Every exercise that breaks management access ends at the CLI, so keep a USB serial cable or a console server in the rack next to the FortiGate.
If you’d rather practise open-source firewalls on the same budget, the pfSense and OPNsense hardware picks cost less and need no licence at all, and the cybersecurity home lab builds show where a firewall fits in a wider practice network.
Which box runs which lab topic
Fortinet’s 2026 program update moved certification to eight NSE levels, with NSE 4: FortiOS Administrator as the proctored exam every higher level requires. Map the topics you’ll study against each option:
| Lab topic | FortiGate-VM eval | 40F | 50G | 60F |
|---|---|---|---|---|
| Policies and NAT | Three policies | Yes | Yes | Yes |
| Static and dynamic routing | Three routes | Yes | Yes | Yes |
| IPsec site-to-site | Low encryption only | Yes | Yes | Yes |
| SD-WAN with two WANs | Uses 2 of 3 vNICs | 1 WAN port, second costs a LAN port | 1 WAN port, second costs a LAN port | Yes, plus DMZ |
| VDOMs | 1 traffic + root | 10 | 5 | 10 |
| SSL deep inspection | Low encryption | 310 Mbps | 1.3 Gbps | 630 Mbps |
| Explicit web proxy, WAF | Available, 2 GB is tight | Removed | Removed | Removed |
| Live IPS and web categories | No FortiGuard | Needs licence | Needs licence | Needs licence |
Read the proxy row before you buy hardware for it. Email proxy inspection came back in 7.6.5, but web proxy, ZTNA and WAF stay removed on all three appliances. Fortinet recommends at least 4 GB of RAM for proxy features on a VM, more than the evaluation allows, so treat the VM as a place to see those menus rather than load them. A learner who needs proxy labs uses the VM, and a learner who needs a real network uses the 60F or the 50G. Split the budget along that line.
