Fortinet · Firewalls
FortiGate 7121F
NGFW for data centres and large-scale environments.
Overview
FortiGate 7121F integrates network security and connectivity through FortiOS. Model selection should consider actual traffic, SSL inspection, FortiGuard services, VPN, high availability and environment growth.
Key features
- Published performanceMaximum figures from the official Fortinet matrix for July 2026.
- Engineering-based sizingFinal sizing accounts for active services, topology, redundancy and expansion.
- Security FabricIntegration with the Fortinet ecosystem according to the defined architecture.
Technical specifications
| Dedicated TPM | Yes |
|---|---|
| Bluetooth Low Energy (BLE) | Dash in the datasheet: feature not listed for this SKU |
| Physical signed-firmware switch | Dash in the datasheet: feature not listed for this SKU |
| Hardware acceleration | NP7 / CP9 |
| Documented optional DAC cables | 40 GE QSFP+ passive DAC cable (SP-CABLE-FS-QSFP+5); 100 GE QSFP28 passive DAC cable, 1m (FN-CABLE-QSFP28-1); 400 GE QSFP-DD passive DAC cable, 1m (FN-CABLE-QSFPDD-DAC-01); 400 GE QSFP-DD passive DAC cable, (FN-CABLE-QSFPDD-DAC-B5) |
| PoE, Wi-Fi and cellular connectivity | PoE output, a Wi-Fi radio and a 5G cellular modem are not listed for this SKU in the datasheet consulted. |
| FIM-7921F — interfaces per module | 2 × 400/100/40 GE QSFP-DD; 18 × 100/40 GE QSFP28 data ports; 2 × 100/40 GE QSFP28 management/HA; 2 × 25/10 GE SFP28 management/HA; 2 × GE RJ45 management ports; 1 USB; 1 console. |
| FPM-7620F — interfaces per module | 2 × 400/100/40 GE QSFP-DD; 8 × 25/10 GE SFP28; 1 console. |
| Data ports — full configuration | 24 × QSFP-DD 400/100/40 GE; 36 × QSFP28 100/40 GE; 80 × SFP28 25/10 GE. |
| Management and HA — configuration with 2 FIMs | 4 × QSFP28 100/40 GE management/HA; 4 × SFP28 25/10 GE management/HA; 4 × RJ45 GE management ports. |
| USB and console — module-level scope | Per FIM: 1 USB and 1 console; per FPM: 1 console. The total depends on the installed module configuration; management modules have their own interfaces. |
| Local storage | 2 × 4 TB SSD per FIM; with 2 FIMs: 4 × 4 TB SSD for logs. |
| Included transceivers | 2 × SFP+ SR 10 GE per FIM; with 2 FIMs: 4 transceivers. |
| Module and power supply variants | Suffix -2: FIM-7941F; suffix -DC: DC power supply. FIM-7941F supports breakout on ports 1–18; FIM-7921F on ports 1–8. |
| IPS | 675 GbpsEnterprise Traffic Mix; logging enabled. Manufacturer laboratory results; actual performance varies with configuration and traffic. Throughput is advertised as a maximum (up to). |
|---|---|
| NGFW | 550 GbpsEnterprise Traffic Mix; firewall, IPS and Application Control enabled; logging enabled. Manufacturer laboratory results; actual performance varies with configuration and traffic. Throughput is advertised as a maximum (up to). |
| Threat Protection | 520 GbpsEnterprise Traffic Mix; firewall, IPS, Application Control and Malware Protection enabled; logging enabled. Manufacturer laboratory results; actual performance varies with configuration and traffic. Throughput is advertised as a maximum (up to). Includes sandboxing enabled, as stated in the note specific to the 7000F series. |
| Firewall IPv4 — UDP 1518/512/64 bytes | 1.89 / 1.88 / 1.129 TbpsLaboratory results; actual performance varies with configuration and traffic. UDP packets of the sizes specified in the metric. |
| Firewall IPv6 — UDP 1518/512/86 bytes | 1.89 / 1.88 / 1.129 TbpsLaboratory results; actual performance varies with configuration and traffic. UDP packets of the sizes specified in the metric. |
| Firewall latency — UDP 64 bytes | 7.50 μsLaboratory results; actual performance varies with configuration and traffic. UDP packets of the sizes specified in the metric. |
| Packet forwarding | 1680 MppsLaboratory results; actual performance varies with configuration and traffic. |
| IPsec VPN — throughput (512 bytes) | 630 Gbps512-byte packets; AES256-SHA256 encryption. Manufacturer laboratory results; actual performance varies with configuration and traffic. Throughput is advertised as a maximum (up to). Measured with VPN load balancing; 10 FPMs installed. |
| SSL-VPN — historical throughput | 13,7 GbpsSSL-VPN benchmark measured on a single FPM, not multiplied by the number of modules installed in the chassis. SSL-VPN tunnel mode was removed from all models as of FortiOS 7.6.3 and replaced by IPsec VPN. SSL inspection is a separate function. |
| SSL inspection — throughput | 540 GbpsIPS; average across HTTPS sessions with different cipher suites. Manufacturer laboratory results; actual performance varies with configuration and traffic. Throughput is advertised as a maximum (up to). |
| SSL inspection — new connections/s | 480 000IPS; average across HTTPS sessions with different cipher suites. Manufacturer laboratory results; actual performance varies with configuration and traffic. Throughput is advertised as a maximum (up to). |
| SSL inspection — concurrent sessions | 100 millionIPS; average across HTTPS sessions with different cipher suites. Manufacturer laboratory results; actual performance varies with configuration and traffic. Throughput is advertised as a maximum (up to). |
| Application control — HTTP 64 KB | 1.5 TbpsHTTP 64 KB; logging enabled. Manufacturer laboratory results; actual performance varies with configuration and traffic. Throughput is advertised as a maximum (up to). |
| CAPWAP — throughput | Not applicable (N/A in the datasheet)Manufacturer laboratory results; actual performance varies with configuration and traffic. Throughput is advertised as a maximum (up to). |
| Concurrent TCP sessions | 1 billion |
|---|---|
| New TCP sessions per second | 9 million |
| Firewall policies | 200 000 |
| Site-to-site IPsec tunnels | 40 000 |
| Client-to-gateway IPsec tunnels | 260 000 |
| SSL-VPN — historical concurrent users (recommended maximum) | 30 000SSL-VPN benchmark measured on a single FPM, not multiplied by the number of modules installed in the chassis. SSL-VPN tunnel mode was removed from all models as of FortiOS 7.6.3 and replaced by IPsec VPN. SSL inspection is a separate function. |
| VDOMs — default / maximum | 10 / 500 |
| FortiTokens — maximum | 20 000 |
| Managed FortiSwitches — maximum | 300 |
| Managed FortiAPs — total / tunnel | Not applicable (N/A in the datasheet) |
| High availability | Active-Active (FGSP), Active-Passive, Clustering |
| Dimensions (H × W × D), inches | 28.63 x 17.33 x 26.6 |
|---|---|
| Dimensions (H × W × D), mm | 727.2 x 440 x 675.5 |
| Maximum weight | 447.36 lbs (203.1 kg) |
| Power supply efficiency | 80Plus-compatible |
| Power supply | 200 to 277 VAC (50/60 Hz) |
| Maximum AC current | 8 x 10A |
| Maximum heat dissipation | 33 261 BTU/h |
| Operating temperature | 32°F to 104°F (0°C to 40°C) |
| Humidity | 5% to 90%, non-condensing |
| Compliance | FCC, ICES, CE, RCM, VCCI, BSMI, UL/cUL, CB |
| Certifications | USGv6/IPv6 |
| Chassis form factor and configuration | 16U; 12 slots (2 FIM + up to 10 FPM). Initial FG-7121F bundle: 2 FIM-7921F, 2 FPM-7620F and 2 management modules. |
| Power consumption — average / maximum | 8296 / 9754 W |
| Storage temperature | −35 to 70 °C |
| Redundant power supplies | 8 hot-swappable power supplies. With 10 FPMs: generation 1 (2000 W/power supply) requires 5 power supplies + up to 3 redundant units; generation 2 (2500 W/power supply), 4 + up to 4 redundant units. |
| FortiGuard licensing and support | FortiGuard services and FortiCare support depend on the purchased bundle or subscription; hardware alone does not imply that all services are included. |
|---|---|
| SSL-VPN and FortiOS version | Published historical capacity; SSL-VPN tunnel mode was removed from all models as of FortiOS 7.6.3 and replaced by IPsec VPN. SSL inspection is a separate function. |
| Lifecycle and document review | End of Order / End of Support are not stated in this datasheet; confirm the official milestones for each SKU before purchasing. |
| Chassis licensing | FortiGuard and FortiCare are purchased per chassis; the datasheet also describes per-chassis pricing for VDOM and Endpoint Compliance. |
Figures published by the manufacturer. Final sizing depends on the environment, enabled services and traffic profile.