Skip to main content
Wade_1
Wade_1
New Member
June 9, 2025
Question

Features of Fortigate without Fortigate security License

  • June 9, 2025
  • 2 replies
  • 2149 views

Hi all

 

Need to know what are the feature that are available in Fortigate box without any security bundle.

 

 

2 replies

funkylicious
SuperUser
funkylicious
SuperUser
June 9, 2025

w/o UTP license, all features expect those that are included in the bundle ( AppCtl, WebFilter, DNS, AV, etc ).

you can do L3/L4 firewall, ipsec, dynamic/static routing, vlans, vip, nat (snat/dnat) etc.

"jack of all trades, master of none"
    Yurisk
    SuperUser
    Yurisk
    SuperUser
    June 9, 2025

    Copy pasting from https://yurisk.info/2022/12/22/fortigate-subscription-expired-list-of-features-that-will-work/  (Checked last time for 7.0.x versions):

     

    When subscription for Fortiguard-based services expires, many things will stop working, but a lot will continue to work still. Below is the full list of features in Fortigate that will continue working after the subscription expires. It also means these features work even if your Fortigate has never had the subscription in the first place.

    Warning
    		VM Fortigate has a license check, which is unrelated to the Fortiguard subscription. This license check requires a non-stop online communication with the Fortiguard servers. The VM Fortigate will stop working completely, if it cannot reach Fortiguard servers for a long time (30 days usually), unless using a special, offline license (most clients don’t).

    • Security rules. The Fortigate will continue filtering traffic according to the Security Rulebase.

    • All kinds of NAT: SNAT, DNAT, VIP, dynamic pools, etc.

    • VPN - all types, IPSec site-to-site, Remote Access as SSL VPN in webmode and full tunnel with Forticlient and as IPSec client.

    • IPS with the signatures last updated before the subscription expired. That is, IPS will continue working, but new signatures will not be downloaded.

    • AppControl using the signatures last updated before the subscription expired.

    • Web/URL Filtering using static allow/block lists. Without subscription the firewall cannot query FortiGuard for URL web ratings, so Web filtering using Fortiguard assigned Categories will not work. But if you use static block/allow URL lists, they will work. Also blocking ActiveX controls will work too.

    • All types of interfaces: physical, VLANs, Virtual Wire, Loopbacks, LAGs, redundant, Zones.

    • Security rules modes: proxy and flow. All modes of proxy mode will work: Explicit, Transparent.

    • SSL/SSH inspection - certificate and deep packet inspection.

    • Applying UTM in both: Policy based and Profile based modes.

    • VDOMs.

    • High Availability (HA).

    • QOS.

    • SD-WAN feature, including AppControl integration (but see above about Application Control signature updates).

    • WAF with the signatures last updated before the subscription expired.

    • VIP of load balancing type.

    • DoS/DDoS protection rules.

    • Device inventory.

    • Access Point controller.

    • FortiSwitch management.

    • All types of logging, Netflow/sFlow export.

    • GRE and VXLAN traffic encapsulation.

    • VRFs, if supported by FortiOS version.

    • One-arm sniffer.

    • Static, all dynamic protocol, and Policy Based routing.

    • All types of authentication: local, LDAP, Radius, Tacacs, SAML, MFA.

    • SNMP.

    • DHCP server.

    • Internet Service Database (ISDB).

    • External Threat Feeds.

    • VOIP protections and profiles.

    • Configuration version revisions.

    • DLP.

       

     

     

    Terms & ConditionsAccessibility statement