Buying Fortinet in the UAE and Saudi Arabia: What the Hardware Price Does Not Cover

A FortiGate is two purchases wearing one part number. There is the appliance, and there is the subscription that makes it a security device rather than a routing device. Buyers who compare quotations on the first number and skim the second are the ones who get a surprise in year two, and in this region there is a ninety day clock that starts whether or not anyone has plugged the box in.

That clock is the single most useful thing to understand before you order. Fortinet's Service Contract Activation and Grace Period Policy gives a grace period of 90 days for hardware-attached service contracts, except for orders shipped to the United States or Canada where it is 60 days. The UAE and Saudi Arabia both sit in the 90 day group.

The clock starts without you

Fortinet's policy states that on the date the grace period expires, and in the absence of an applicable registration event, the service contract will automatically start. It also states that it is the customer's responsibility to register and activate service contracts and bundles within their Fortinet support portal account, FortiCloud.

Put those two sentences together and the consequence is concrete. A firewall ordered for a fit-out that slips, sitting in a cupboard in Business Bay for four months while the contractor finishes, has already begun consuming a subscription nobody has used. The device was never racked. The licence does not care, and nothing in the box tells you the clock is running. For a project with a long lead time between delivery and cutover, the registration date is a line item worth managing deliberately rather than leaving to whoever opens the box.

The practical step is to agree with your supplier, in writing, who registers the unit, into which FortiCloud account, and on what date. A distributor that registers hardware into its own account and transfers it later is doing something different from one that registers it into yours on delivery, and the difference shows up when you raise your first support case.

What the bundles actually contain

Fortinet sells its FortiGate subscriptions as curated bundles that nest inside one another, which makes comparison easier than most vendors manage. The structure as Fortinet publishes it runs in three steps.

• ATP covers intrusion prevention, anti-malware and application control, with FortiCare Premium support included.
• UTP is ATP plus DNS filtering, URL filtering, video filtering and anti-botnet services.
• Enterprise Protection is UTP plus CASB, data loss prevention, IoT detection, attack surface monitoring and AI-based inline malware prevention.

All three bundles include FortiCare Premium technical support on a 24x7x365 basis, so support is bundled rather than optional. The decision is therefore not whether to buy support, since it travels with the bundle, but how far up the feature stack your actual policy reaches. An office that will never configure data loss prevention is paying for Enterprise Protection it does not use, and an office that bought ATP and then asked for URL filtering has bought one tier too low.

What stops working when it lapses

This is the part worth knowing before renewal season rather than during it, because the two services fail in different ways.

When FortiGuard services expire, the FortiGate does not go dark. Fortinet's own guidance describes the device continuing to operate as a classic layer 3 firewall with cached functionality, retaining cached antivirus, application and IPS signatures while losing access to FortiGuard threat intelligence. Traffic keeps flowing. The box simply stops learning about anything new, which is a failure mode that produces no alarms and no outage, and is therefore the easiest one to not notice for a year.

When FortiCare support expires, you lose hardware or VM support and cannot get assistance from Fortinet, and you lose the ability to upgrade firmware. That second consequence deserves weight. A firewall you cannot patch is a security problem in its own right, and the moment you most want to apply a firmware fix is usually the moment you discover the contract lapsed. Plan renewals against the firmware roadmap rather than against the calendar alone.

Saudi Arabia adds a conformity step the UAE does not

Shipping the same appliance into Riyadh rather than Dubai is not the same transaction. Saudi imports run through the SABER platform and SASO conformity requirements, and the certificate work sits upstream of the shipment rather than alongside it. A quotation that is accurate for a Dubai delivery can be weeks optimistic for a Saudi one if nobody has started the conformity paperwork.

If Saudi delivery is in scope, read the SABER and SASO requirements for IT hardware before you commit to a cutover date, and ask your supplier which party is named on the conformity certificate. For UAE deliveries the equivalent question applies to the wireless variants, where regulatory domain settings and local type approval decide whether the hardware you received is the hardware you are allowed to switch on.

Sizing is a separate argument, and it comes first

None of the above helps if the model is wrong. Fortinet publishes headline throughput figures measured without inspection enabled, and the number that survives contact with a real office is the one measured with the features you actually intend to run. The gap between those two figures is large enough to turn a correctly licensed firewall into a bottleneck.

Work the sizing out before the licensing, using the inspected figures rather than the brochure figures, and sense-check the result against what your office actually loads. If you are still comparing vendors rather than models, the three entry appliances compared side by side is the place to start.

What to send with the enquiry

Six things turn a vague request into a quotation you can hold someone to. State your internet bandwidth and the inspection features you intend to enable, because those two decide the model. State the bundle tier and say why, so nobody quietly quotes you one step down. State the term, since one year and three year contracts price differently and renew differently. State the delivery country, because Dubai and Riyadh are different compliance paths. State who registers the unit and into which FortiCloud account. State your expected deployment date, so the ninety day grace period is managed rather than discovered.

Codeeo Tech is a Fortinet distributor supplying the UAE and Saudi Arabia from Building A1, IFZA Business Park in Dubai Silicon Oasis, alongside Cisco, HPE, Dell EMC, Juniper and NVIDIA. Browse the Fortinet range or send the six points above through the contact form, and the quotation will come back against that specification with the licensing and registration questions answered rather than left open.

Cover photo: KAFD 37, via Wikimedia Commons (CC0).