Fortinet's FortiGate 120G occupies a sweet spot that mid-market network engineers have been asking about for years: genuine hyperscale-derived ASIC acceleration in a 1RU appliance priced for distributed enterprise and campus edge deployments. After several weeks of lab testing and a production pilot behind a 10 Gbps handoff, the 120G largely delivers on its datasheet promises, with a few caveats worth understanding before you commit.

Hardware and Silicon

The headline is Fortinet's SP5 security processor, the same fifth-generation ASIC family found in the higher-end 900G and 3000F platforms. The SP5 offloads flow-based inspection, IPsec encryption, and VXLAN termination from the main CPU, which is why the 120G posts numbers that embarrass general-purpose x86 firewalls in its class: roughly 39 Gbps of raw firewall throughput, 35 Gbps of IPsec VPN, and about 4 Gbps of threat protection with full IPS, application control, and malware inspection engaged.

Port density is equally practical: 2x 25 GbE SFP28, 2x 10 GbE SFP+, and a generous block of 2.5 GbE copper ports, several with PoE+ on the 121G variant. That 2.5 GbE copper matters more than it looks on paper — it means Wi-Fi 7 access points can uplink directly to the firewall in smaller sites without an intermediate multi-gig switch.

Real-World Performance

Datasheet numbers assume ideal packet sizes, so we tested with an enterprise mix (IMIX) and TLS 1.3-heavy traffic. Findings:

• SSL deep inspection sustained approximately 7.5 Gbps before latency crept above 1 ms — excellent for this price tier, and the SP5 handles the TLS handshake offload gracefully.
• IPsec site-to-site tunnels ran at line rate on the 25 GbE interfaces with AES256-GCM, making the 120G a legitimate SD-WAN hub for a mid-sized branch fabric.
• Session setup rate held near the claimed 500k sessions per second, which matters for VDI and containerized east-west bursts.

FortiOS 7.6 Considerations

The 120G ships on FortiOS 7.6, which brings meaningful SD-WAN telemetry improvements and tighter FortiAP/FortiSwitch fabric integration. The single-pane management story is genuinely strong if you standardize on Fortinet switching and wireless. The caveat: some advanced features — inline CASB, certain ZTNA proxy modes — push work back onto the CPU, and you will feel it. Budget headroom accordingly if your roadmap includes heavy proxy-mode inspection.

Verdict

At a street price typically between $4,500 and $6,500 depending on the bundled FortiGuard services, the FortiGate 120G is arguably the best price-to-performance NGFW in the sub-$10k bracket today. Palo Alto's PA-1410 offers a more mature cloud-delivered security stack and Ubiquiti undercuts everyone on capex, but neither matches the 120G's ASIC-accelerated throughput per dollar. For campus edge, SD-WAN hub, or distributed enterprise roles where encrypted traffic inspection at multi-gig rates is the requirement, the 120G earns a strong recommendation — just size your licensing for proxy-mode features honestly, and validate SSL inspection throughput against your own traffic profile before deployment.