Used enterprise firewalls are one of the best deals in homelab and small-office hardware. A FortiGate 100F that retailed for €4,000 can be had for €400–600 on the secondary market. But unlike a used switch or server, a firewall has pitfalls specific to the platform that can turn a bargain into a headache. This guide focuses on FortiGate because Fortinet dominates the SMB/branch market — which means the widest used supply — but most principles transfer to other NGFW vendors.
Why FortiGate specifically
FortiGate runs FortiOS, a mature, well-documented OS with a strong CLI, solid VPN (IPsec + SSL), IPS, web filtering, SD-WAN, and ZTNA features. Even old models (6.0-era hardware) run a recent enough FortiOS to be genuinely useful. The management UI is clean, the CLI is learnable, and there's a large community behind it.
The catch: Fortinet's subscription model means some features (IPS signatures, web filter categories, AV databases) are tied to a license. Hardware without an active license still works great as a stateful firewall and VPN concentrator — the signatures just stop updating. For homelab and many SMB use cases, that's acceptable.
What to check before buying
1. Hardware generation and throughput
FortiGate model numbers encode rough throughput:
- FortiGate 40F / 60F: ~1 Gbps firewall throughput — fine for fiber ≤1 Gbps and a small team
- FortiGate 80E / 100E / 100F: 2–10 Gbps — suitable for mid-size offices, remote-access VPN hubs, or a demanding homelab VLAN setup
- FortiGate 200E / 300E / 400F: 20–40 Gbps — branch aggregation or small datacenter edge
The "E" suffix = 6.x-era hardware (NP6/SP3 ASICs). The "F" suffix = 7.x-era (NP7/SOC4). Both are fully supported as of FortiOS 7.4.
Also check the number of physical interfaces. Some models have SFP+ ports that are useful for direct fiber uplinks or inter-zone 10G links; verify they match your cabling.
2. License status
Run or ask the seller to run:
get system status
Look for License Status: Valid or Expired. An expired license means:
- Stateful firewall ✅
- IPsec/SSL VPN ✅
- VLAN, routing, NAT ✅
- IPS signatures ❌ (frozen at expiry date)
- Web filter categories ❌
- FortiGuard DNS filtering ❌
For a homelab or budget office, unlicensed is often fine. For a production environment that needs up-to-date threat intelligence, budget for a license renewal or buy a unit that still has active FortiCare.
3. FortiOS version and upgrade path
Fortinet's firmware lifecycle is strict:
- Check Fortinet's product lifecycle page for EoS dates
- FortiGate 80E and older are approaching or past EoS — fine for air-gapped or homelab, a risk for internet-facing production
- From the CLI:
get system statusshows the current version
The good news: FortiOS upgrades between major versions (e.g. 6.4 → 7.0 → 7.2) are straightforward via the GUI, and Fortinet publishes upgrade path tools to avoid skipping versions.
4. Factory reset status
Always ask: "Has this been factory-reset?" A unit that still has a previous org's config is usable but requires extra care:
- Previous VPN credentials could be cached
- Custom certificates may still be present
- If you get a unit without the admin password, you CAN reset it via the console port and a BIOS interrupt — but you need a RJ45-to-DB9 console cable or a USB console adapter
The console reset procedure is documented in Fortinet's knowledge base and takes about 5 minutes. It's not a dealbreaker, but confirm before buying whether the seller has done it.
5. PSU and accessories
Mid-range FortiGates (200E+) use redundant PSUs in some configurations. Check:
- Is both/the PSU included?
- Any rack ears?
- Console cable? (3rd-party USB console cables work fine — CP210x chip)
Which model for which use case?
| Use case | Recommended models |
|---|---|
| Home fiber ≤1 Gbps + VPN | FortiGate 40F, 60F, 60E |
| Small office (≤50 users) | FortiGate 80E, 100E, 100F |
| VPN concentrator (branch hub) | FortiGate 100F, 200E |
| Lab firewall / VLAN isolation | Any 60E/80E — cheap, plenty of ports |
| Multi-tenant / advanced routing | FortiGate 300E, 400F |
For pure homelab VLAN segmentation without active IPS, a FortiGate 60E running FortiOS 7.2 is the sweet spot: cheap, well-documented, 5 physical interfaces, capable CLI.
Configuration tips after buying
-
Factory reset first:
execute factoryresetin the CLI, even if the seller says it's clean. - Update firmware before touching production traffic. Download directly from support.fortinet.com (free, needs a (free) account).
-
Disable FortiGuard reachability checks if you're running unlicensed — the unit will log repeated license check failures otherwise. Under
System > FortiGuard, disable services you're not using. - Use policy-based NAT + security zones from day one — trying to retrofit zones later is painful.
- Enable logging to memory or a syslog server (e.g. Graylog, Loki). Local disk logging on small FortiGates is limited and fills fast.
Where to find tested units
Auctions (eBay, Marktplaats) are hit-or-miss: units sometimes arrive still linked to a previous MSP's FortiManager, or with burned PSUs. Specialist resellers that test, reset, and warrant used enterprise gear are worth the small price premium — if you're in Europe and want reset, tested FortiGates with a warranty, IT and Office maintains a rotating stock of used firewalls from major brands.
What's your homelab firewall setup?
Running FortiGate, pfSense, OPNsense, or something else? Any surprising finds from the used market — good or bad? Drop a comment below.
Top comments (0)