FortiGate vs Palo Alto licensing: what needs a subscription

Two different seams

Both vendors sell an appliance that does little on its own and subscriptions that make it useful. The structure of those subscriptions differs.

Fortinet sells nested tiers

Fortinet groups FortiGuard security services into bundles that build on each other. The ATP tier covers the core intrusion prevention and malware services. The UTP tier adds the web-facing services, including URL and DNS filtering, video filtering and anti-botnet protection. The Enterprise tier adds broader attack-surface services such as data loss prevention, attack surface risk scoring, inline malware prevention and IoT detection. All three include FortiCare premium support.

A customer who wants exactly two capabilities buys the tier that contains both. Where those two capabilities sit in different tiers, they buy the higher tier and receive services they will never enable. Moving between tiers at renewal is a step rather than an increment.

Palo Alto sells named capabilities

Palo Alto names a subscription per capability. The cloud-delivered services currently include Advanced Threat Prevention, Advanced WildFire, Advanced URL Filtering, Advanced DNS Security, IoT Security, SaaS Security and SD-WAN.

A customer who wants exactly two capabilities buys exactly two subscriptions. The cost of that precision is that the security posture they believe they bought is several separate line items. Dependencies exist between them, and DNS Security requires a valid Threat Prevention license. A missing subscription is straightforward to overlook until the day it matters.

Bundle and subscription structure taken from each vendor's current Fortinet ordering guide and Palo Alto Networks subscription documentation, checked 8 August 2026. Names and membership change between revisions on both sides, so confirm against the document your reseller is quoting from rather than against this page.

The capability matrix

Read this as a description of how each capability is licensed rather than as a scorecard. The rows where the two vendors differ structurally are the rows worth arguing about in a quote review.

Compiled from Fortinet's FortiGuard bundle and FortiClient ordering documentation, Palo Alto Networks subscription documentation, and the GlobalProtect licensing documentation. Checked 8 August 2026. This is the fastest-aging page in this library and carries a hard quarterly review.

Remote access is the row that surprises people most often, because both vendors ship a usable client for free and license the features an MSP actually needs on top of it. What each client includes without a license, and what the managed deployment costs, is set out on the remote access page.

Where MSPs get caught

Four patterns account for most of the licensing surprises we see after a sale.

The capability that is visible and inert

Both platforms show configuration for capabilities the customer has not licensed. The setting accepts input, the policy references it, and the enforcement depends on a subscription that is absent. An engineer who configures from the interface rather than from the order can build a policy that looks complete and inspects less than it appears to.

Verify licensed capabilities from the license status page rather than from the presence of a configuration tab.

The feature that needs the management platform

Some capabilities exist on a single appliance and become impractical across an estate without central management. Both vendors license central management by device count, so growth in the estate carries a licensing consequence that first appears about a year after the original purchase.

The endpoint license behind the firewall feature

Endpoint posture checking is a firewall feature that depends on client-side licensing on both platforms. On Palo Alto, HIP checks require a GlobalProtect gateway license. On Fortinet, managed endpoint capability requires a FortiClient EMS server license plus per-endpoint subscriptions, and the free standalone client covers basic VPN connectivity only.

A customer promised conditional access based on device health has been promised endpoint licensing whether or not the quote mentions it.

The dependency between subscriptions

Subscriptions that depend on other subscriptions produce quotes that are internally incomplete. The DNS Security dependency on Threat Prevention is the documented example, and it is unlikely to be the only one by the time you read this. Ask the reseller which items on the quote have prerequisites.

The one clear divergence

SD-WAN is the row where the two licensing models produce a genuinely different answer.

Fortinet includes Secure SD-WAN in FortiOS. It is configurable on a FortiGate without a separate SD-WAN license or an additional orchestrator product. Palo Alto licenses SD-WAN as a subscription, required on each physical appliance that participates in the deployment.

At one site this difference is a line item. At two hundred sites it is a material share of the program. The licensing difference is a fact about cost, and whether it should decide the architecture is a separate question with real arguments on both sides.

Those arguments are the subject of the SD-WAN page, including the case against putting WAN and security in the same failure domain.

What happens on expiry

This section matters more operationally than the purchase question and almost nobody writes it down.

Both platforms keep forwarding traffic when a subscription lapses. The appliance does not stop. What degrades is everything that depends on live lookups or content updates, and the two platforms carry different default behaviour when that happens.

Expiry behaviour compiled from vendor documentation and vendor community guidance, checked 8 August 2026. Behaviour is configurable and version dependent on both platforms. Test it on the customer's own configuration in a maintenance window rather than taking a default from this page into a production incident.

The practical difference is the direction each platform fails in by default. A FortiGate whose web filtering subscription lapses tends toward blocking, so the customer notices within minutes and calls. A Palo Alto whose URL filtering lapses tends toward permitting, so the customer notices nothing and the protection they are paying for is absent.

Both directions have a cost. Set the behaviour deliberately on both platforms, and tell the customer which one you selected for them.

Confirm before signature

Send these in writing and keep the answers with the order.

1. List every capability included in this quote, by capability rather than by bundle name.
2. Which capabilities in your product line are absent from this quote?
3. Which items on this quote require another subscription to function?
4. Does this quote include central management, and at what device count does it become necessary?
5. Does the remote access described here require any client, endpoint or posture licensing beyond the firewall?
6. Where do logs land, how long are they retained, and what does extending that cost?
7. What is the expiry date of each subscription, and are they co-terminated?
8. If a subscription lapses, what stops working, what keeps working, and what is the default traffic behaviour?
9. What does each subscription cost to renew in each year after the initial term?
10. For a high-availability pair, which items are required on both units?

Question eight is the one that separates a quote review from a quote comparison. Question ten changes the total on roughly every high-availability deal we see.