When 100GE links hit the firewall, sizing mistakes get expensive

A data centre firewall is rarely stressed by simple packet forwarding. The pressure starts when IPS, application control, antivirus, web filtering, SSL inspection, segmentation rules, VPN traffic, and logging all land on the same appliance. That’s where a raw firewall number can mislead a buyer.

The Fortinet FG-3400E / FG-3401E is built for enterprise edge, data centre edge, large campus networks, MSSP security zones, and high-throughput private cloud environments. It gives you 240 Gbps firewall throughput and 25 Gbps threat protection throughput, so the sizing conversation is based on inspected traffic, not just clean UDP forwarding.

For Dubai deployments, that difference matters. A firewall sitting between Etisalat Business and du Enterprise WAN links, a DIFC private cloud rack, a JAFZA warehouse network, or a Gulf Data Hub cabinet can’t be sized like a branch office box. You need port density, HA design, inspection capacity, and cooling load checked together.

FortiGate 3400E / 3401E product overview

The FG-3400E and FG-3401E sit in the large enterprise FortiGate range. Both models share the same firewall, IPS, NGFW, threat protection, VPN, session, and interface performance. The key difference is storage. The FG-3400E is the base model. The FG-3401E includes onboard SSD storage, useful when the design needs local logging, reporting, or event retention at the firewall layer.

Port layout is one reason this model is still requested for data centre edge projects. You get 4 x 100GE QSFP28 / 40GE QSFP+ slots and 24 x 25GE SFP28 / 10GE SFP+ / GE SFP slots. That makes the appliance suitable for mixed environments where core switches, aggregation switches, WAN routers, and security zones are not all running at the same speed.

In plain terms: you can terminate 100GE uplinks, keep 25GE or 10GE security zones, and reserve dedicated interfaces for HA without turning the design into a patch-panel headache. For enterprise networks in Dubai, Abu Dhabi, Sharjah, Ajman, Ras Al Khaimah, Fujairah, and Umm Al Quwain, that interface mix gives network teams room to phase upgrades over time.

The appliance is a 2U rackmount firewall. That matters for cabinet planning. With redundant hot-swappable power supplies, multiple high-speed optics, and enterprise airflow requirements, it belongs in a proper server room or data centre rack. Not under a desk. Not in a shallow wall cabinet. Give it the rack depth, cooling, and cable management it deserves.

For FortiGate model planning across the UAE, start with the FortiGate firewall Dubai range, then size the final appliance using threat protection throughput, number of WAN links, inspected east-west traffic, VPN load, VDOM count, and HA design.

FortiGuard licensing: hardware is only half the design

The FG-3400E / FG-3401E hardware gives you the platform. FortiGuard gives you the live security services. Without the right bundle, the firewall can still route, NAT, build policies, and inspect sessions as a stateful firewall, but security teams lose the feeds and engines that make threat protection useful.

For most Dubai enterprise projects, the licensing decision is between UTP Bundle and Enterprise Bundle. UTP is usually the starting point when the firewall is doing edge protection, IPS, web control, and malware inspection. Enterprise is used when the environment needs a wider security subscription set, especially for larger networks with OT, IoT, cloud access, or migration requirements.

For HA pairs, licensing needs to be counted per firewall. That catches people. Two appliances in Active-Passive HA still need the right subscriptions on both units. The standby unit has to be ready to take over with the same inspection profile, same policy behaviour, same web filtering category handling, and same IPS coverage.

If your project includes central log retention, compliance reporting, or SOC monitoring, pair the firewall with FortiAnalyzer 3000F Dubai or another FortiAnalyzer model sized for the event rate. For FG-3400E deployments, that is usually cleaner than depending only on local firewall storage.

Technical specifications

The figures below are the sizing numbers buyers usually need before raising a purchase request or checking an RFP bill of quantity. Always compare firewall throughput and threat protection throughput together. Quoting only the 240 Gbps firewall number does not reflect a real inspected security design.

HA and redundancy planning

Most FG-3400E and FG-3401E projects are not single-firewall deployments. They go in as HA pairs, usually at the data centre edge, core security layer, or internet perimeter. The platform supports Active-Active, Active-Passive, and clustering designs, so the final choice depends on the routing design, inspection load, failover target, and change-control policy.

For many UAE enterprise sites, Active-Passive is the cleaner design. One firewall handles the production traffic, the second waits with matching policy, interfaces, routing, FortiGuard licensing, and session sync. When a hardware fault, power issue, or planned maintenance window hits, traffic can move to the standby unit without rebuilding the edge.

Active-Active can make sense when the design needs load sharing, but it needs more care. Policy design, asymmetric routing, session handling, and troubleshooting all become more sensitive. For bank networks, government environments, airport infrastructure, and managed security platforms, that planning should be done before the purchase order, not during the installation window.

The safer way: size the pair using inspected throughput, check peak session count, confirm HA mode, map the 100GE and 25GE links, then price the two appliances with matching 1-year or 3-year FortiGuard bundles. Simple on paper. Painful when skipped.

2U rack deployment context

The FG-3400E / FG-3401E is a 2U rackmount firewall for enterprise and data centre racks. It is not a small office appliance. Typical deployments include data centre edge security, internet perimeter, inter-VLAN inspection, private cloud segmentation, MSSP customer zones, and large campus firewalling.

In Dubai, this model fits environments with 100GE uplinks, multiple 25GE zones, and HA pair requirements. Think Equinix DX1/DX2, Khazna, Gulf Data Hub, DIFC financial networks, DAFZA technology firms, JAFZA logistics groups, hotel chains, and government departments where traffic inspection cannot be treated as optional.

A practical user range is 5,000+ users, but user count alone is not enough. A 2,000-user bank with SSL inspection, VPN, east-west traffic, and heavy logging can push harder than a 7,000-user office with lighter inspection. Size it by threat protection throughput, session count, interface speed, FortiGuard services, and HA failover target.

Refresh path from FG-3400E / FG-3401E

Many FG-3400E and FG-3401E units in the UAE are already in serious production networks. Before replacing one, check why the refresh is happening. Is it port speed? Threat inspection load? SSL inspection? VDOM growth? Power draw? Support lifecycle? Or simply a wider data centre redesign?

If the project needs a newer 2U FortiGate with strong inspected throughput, the FortiGate 3000F Dubai is usually the first comparison point. It is a newer F-Series platform with 397 Gbps firewall throughput and 33 Gbps threat protection throughput, which makes it a useful option when a 3400E estate is due for refresh.

For teams looking at next-generation FortiGate architecture, the FortiGate 3000G Dubai should also be checked. It uses the newer G-Series platform and is better suited when power-per-Gbps, rack density, and longer refresh planning are part of the decision. Not every 3400E should be swapped blindly. Map the ports and inspected traffic first.

What’s in the box

A typical FG-3400E / FG-3401E shipment includes the firewall appliance, rackmount hardware, power cables depending on order region, and 2 x SFP+ SR 10GE transceivers. The unit ships with dual AC power supplies by default, giving 1+1 power redundancy for data centre use.

The FG-3400E does not include onboard SSD storage. The FG-3401E includes 2 x 2TB SSD, giving 4TB total onboard storage. That storage difference is the main reason buyers choose the 3401E when local event retention or local reporting is needed at firewall level.

Related FortiGate models in Dubai

Choosing the FG-3400E / FG-3401E usually means the network is already at data centre scale. Still, a few nearby models should be checked before final approval, especially when the project includes branch firewalls, HA pairs, or a phased refresh.

UAE deployment notes

For Etisalat and du enterprise circuits, map the WAN handoff speed before selecting optics. Some designs need 10GE today but have 25GE or 100GE refresh planned within the same contract cycle. The 3400E interface mix helps when WAN, core, DMZ, and server zones are moving at different speeds.

DIFC and DMCC networks often need cleaner segmentation, stricter log retention, and better audit trails than a standard office firewall. JAFZA and DAFZA sites may care more about dual WAN, warehouse WiFi segmentation, camera VLANs, and remote access VPN. Same firewall. Different policy design.

Cooling also matters. Two 2U appliances in an HA pair, plus 100GE optics, plus dense cabling, can add real heat inside a rack. In Dubai data centres, power and airflow planning should be done before the engineer arrives with the rails and cable labels.

Africa, GCC and MEA export from Dubai

Vector Digital Systems supplies Fortinet FG-3400E and FG-3401E for enterprise projects across the UAE, GCC, Africa, and South Asia. FOB Dubai pricing is available for approved export orders, including HA pairs and FortiGuard 3-year bundle projects.

Common project routes include Saudi Arabia, Qatar, Oman, Kuwait, Egypt, Kenya, Tanzania, Nigeria, South Africa, and Pakistan. For enterprise and government shipments, confirm exact SKU, bundle term, end-user details, destination, and optics list before invoicing. Large orders can be quoted with staged delivery from Dubai where stock and project allocation allow.

FG-3400E / FG-3401E FAQ

What is the threat protection throughput on the Fortinet FG-3400E?

The Fortinet FG-3400E delivers 25 Gbps threat protection throughput. Firewall throughput is 240 Gbps for large packet traffic, but threat protection is the better number for sizing when IPS, application control, web filtering, and antivirus are enabled.

Is the FG-3401E faster than the FG-3400E?

No. FG-3400E and FG-3401E use the same performance figures: 240 Gbps firewall throughput and 25 Gbps threat protection throughput. The main difference is storage. FG-3401E includes 2 x 2TB SSD, while FG-3400E is the base model without onboard SSD storage.

Does the FG-3400E support HA?

Yes. The FG-3400E / FG-3401E supports Active-Active, Active-Passive, and clustering. For Dubai data centre deployments, Active-Passive HA is common because it gives a cleaner failover design with matching policies, FortiGuard licensing, routing, and session sync.

What FortiGuard bundles are available?

FortiGuard UTP Bundle and Enterprise Bundle are available in 1-year and 3-year terms. UTP includes IPS, Application Control, Web Filtering, Antivirus, FortiSandbox Cloud, and Botnet protection. Enterprise adds services such as FortiCASB, FortiConverter, Industrial Security, and IoT Detection.

What is the form factor of the FG-3400E?

The FG-3400E / FG-3401E is a 2U rackmount firewall. It is designed for enterprise racks, data centre cabinets, and large server rooms with proper airflow, power, and cable management.

How many VDOMs does it support?

The FG-3400E / FG-3401E supports 10 VDOMs by default and up to 500 VDOMs maximum. That makes it suitable for segmented enterprise, multi-tenant, MSSP, and large data centre security designs.