The firewall a South African small business actually needs
Not the enterprise sales pitch, not a decade-old review of discontinued boxes — the current answer. Which unit fits your headcount, what it really costs in rand (hardware and the licence nobody mentions), and the three mistakes that waste SMB money.
Why your business needs more than the router's firewall
The firewall inside your fibre router blocks unsolicited traffic — and that's roughly all it does. A next-generation firewall (NGFW) inspects what's inside the traffic: it stops known malware at the perimeter, blocks phishing and malicious sites before a browser renders them, filters what employees can reach, and gives you one place to run secure branch-to-branch and work-from-home VPNs. For a business with payroll data, customer records and POPIA obligations, that's the difference between "we have internet" and "we're defensible".
Sizing: match the box to the humans
Firewall sizing is mostly a headcount question — with headroom for the security scanning that makes the device worth owning:
1–10 people (micro office, shop, site office): FortiGate 30G or 40F class. Desktop units, silent, out of the way. The 30G is the newer generation — the forward-looking pick.
10–40 people (the typical SA SMB): FortiGate 60F class — the most deployed small-business firewall in the country, for good reason. FortiWiFi variants exist if the unit must also be your office WiFi.
40–120 people (growing office, multiple branches): FortiGate 80F or 90G class — more throughput headroom, more ports, PoE options, and on the 90G, current-generation hardware with 10G uplinks.
Heavy VPN, VoIP, CCTV or on-prem servers? Size one class up. It's the cheapest headroom you'll ever buy.
Our model comparison and sizing matrix lays this out per unit, and if you'd rather not decide alone: send your user count with the quote request and we'll recommend.
What it costs — the honest rand picture
Two numbers, not one:
The hardware. As a 2026 market guide, entry and SMB-class FortiGate units typically land somewhere in the R8,000–R25,000 range depending on model and generation. (You'll see wild outliers online — marketplace listings of discontinued models on one end, imported bundles at double the going rate on the other. Both are traps; more below.)
The licence. The recurring subscription — FortiCare support plus a security bundle, usually UTP for SMBs — is what keeps the protection current. It's priced per model per year, and multi-year terms (24/36 months) meaningfully lower the per-year cost. This is the number most first-time buyers discover only at renewal time; budget it from day one.
Exact pricing moves with the model, bundle, term and exchange rate — which is why we quote per configuration, in rand, VAT shown, usually within business hours. Here's what drives the price if you want the mechanics.
The three mistakes that waste SMB money
Buying yesterday's model because it's listed cheap. SA marketplaces still rank pages for units Fortinet discontinued years ago (30D/30E-era). A short support runway and an ageing security processor is no bargain — check the generation before you pay. If in doubt, here's how FortiGate end-of-life actually works.
Buying hardware without the bundle. "Device only" listings look cheaper because they omit the part that does the protecting. Compare unit-plus-licence to unit-plus-licence, or you're comparing a car with and without an engine.
Letting the licence lapse. The firewall keeps passing traffic when the subscription expires, so nobody notices — while signatures age and support disappears. (We track expiry dates for our clients and remind them before it bites; here's what expiry actually does.)
Where to buy — and why the channel matters
FortiGates in South Africa flow through Fortinet's official distribution channel. Buying through the genuine channel means your serial is registered correctly, your licence activates in South Africa, and your warranty and support actually work here — none of which is guaranteed with grey imports. TechCo ICT supplies through the official SA channel, delivers nationally, registers the unit against your business, and then tracks your renewal dates so the protection never quietly lapses. One supplier, both halves of the job: the unit and every renewal after it.