Built for heavy data centre traffic, not branch-office guesswork

At data centre scale, firewall sizing gets uncomfortable fast. A clean 100G link on paper becomes something else once IPS, antivirus, application control, NAT, routing, VPN, and internal segmentation policies are running at the same time. That’s where many procurement mistakes happen in Dubai. The appliance is bought on raw firewall throughput, then the network team discovers the inspected traffic number is the one that actually matters.

The Fortinet FG-3960E is a 5U rackmount FortiGate built for data centre edge, service provider aggregation, large campus core, and high-capacity enterprise networks. It delivers up to 620 Gbps firewall throughput and 13.5 Gbps threat protection throughput. Both numbers matter. One tells you how fast the firewall can forward clean traffic. The other tells you what happens when security inspection is turned on.

For UAE deployments, that distinction is not academic. A firewall sitting between Etisalat Business links, du Enterprise circuits, hosted workloads, and internal server VLANs needs to be sized for real inspection. Especially in DIFC financial offices, DMCC multi-tenant environments, JAFZA warehouses, DAFZA technology companies, hospitality groups, government networks, and data centre racks where downtime gets expensive quickly.

Fortinet FG-3960E product overview

The FG-3960E belongs in networks where 10G and 100G ports are already part of the design. It is not a desktop firewall. It is not a small server-room appliance. This is a carrier and enterprise-grade FortiGate for teams dealing with large routing tables, high session counts, segmented tenants, east-west traffic inspection, and strict maintenance windows.

Port layout is one of the main reasons buyers still ask for the FG-3960E in Dubai. The appliance includes 16 x 10 GE SFP+ interfaces and 6 x 40/100 GE QSFP+/QSFP28 slots, plus dedicated GE management ports, USB, and console access. That gives architects enough room for upstream routers, aggregation switches, server farm connections, data centre interconnects, and HA sync designs without wasting the first design meeting on adapter workarounds.

Inside the platform, traffic acceleration is handled by multiple NP6 processors connected through an integrated switching fabric. That matters when your design includes several 10G links, high-throughput VLANs, or single traffic streams that need more than ordinary software forwarding. In plain language: the FG-3960E was designed to push serious traffic through purpose-built Fortinet silicon, not general CPU inspection alone.

For a broader FortiGate range comparison, see the FortiGate firewall Dubai hub page. If the project is a refresh from older 3000E, 3400E, 3600E, or 3700D platforms, sizing should include both today’s link speed and the next Etisalat or du WAN upgrade already planned by the business.

FortiGuard licensing for FG-3960E

The hardware is the platform. FortiGuard is where the security inspection comes from. Without an active FortiGuard subscription, the FG-3960E can still operate as a stateful firewall, but buyers should not expect current IPS signatures, web filtering categories, antivirus definitions, FortiSandbox Cloud checks, botnet intelligence, or other live threat services without the right licence.

For most enterprise and data centre deployments in the UAE, the normal buying choice is between the UTP Bundle and the Enterprise Bundle. Both are available in 1-year and 3-year terms. A 1-year term keeps the first purchase lower. A 3-year term usually suits project budgets, HA pairs, and refresh cycles because the per-year cost is lower and the renewal date is easier to manage.

For a bank HQ in DIFC, an airline support network near Dubai Airport, or a free-zone operator with many tenant VLANs, the Enterprise Bundle can make sense because visibility beyond the firewall becomes part of the design. For a pure edge firewall with IPS, app control, malware scanning, and URL controls, UTP may be enough. The right answer depends on traffic type, compliance scope, and whether the firewall will sit inside a wider Security Fabric.

FG-3960E technical specifications

The table below keeps the buying numbers in one place. For firewall sizing, compare the 620 Gbps firewall throughput with the 13.5 Gbps threat protection throughput. For HA and tenant design, pay attention to sessions, policies, VDOMs, interfaces, and power.

HA and redundancy planning

The FG-3960E supports Active-Passive, Active-Active, and clustering designs. Most enterprise buyers in Dubai choose an HA pair for this class of firewall, because a single appliance at the data centre edge becomes a business risk. When the firewall sits in front of ERP, payment systems, hosted applications, VPN users, or shared tenant networks, planned failover is not a luxury.

Active-Passive is usually the cleaner design for regulated environments. One firewall handles live traffic. The second unit stays synchronised and takes over during failure or maintenance. Active-Active can be used where traffic distribution is required, but it needs tighter design discipline around session handling, asymmetric routing, logging, and policy behaviour.

For Dubai data centre deployments, plan the HA links before ordering transceivers. Leave dedicated capacity for heartbeat, session sync, management, logging, and FortiAnalyzer connectivity. In 45°C outside ambient conditions, rack cooling and power draw still matter even inside a proper facility. A 5U firewall with 7200 BTU/h heat dissipation deserves proper rack placement, blanking panels, and front-to-back airflow.

For projects where centralised logging, reporting, and incident review are required, pair the FG-3960E with a FortiAnalyzer appliance or VM sized for log volume. This is common in DIFC, government, healthcare, and MSSP environments where firewall events must be searchable after the incident, not only visible during the incident.

5U form factor and data centre deployment context

The FG-3960E is a 5U rackmount firewall. That size matters. It needs proper rack depth, front-to-back airflow, structured fibre patching, and enough clearance for service access. In a Dubai data centre rack, don’t plan it like a 1U branch firewall. Plan it like a core network appliance sitting between upstream WAN, data centre switching, hosted applications, and internal security zones.

Typical deployment size is 5,000+ users, large east-west traffic volumes, multi-site VPN, MSSP edge, government networks, carrier aggregation, or multi-tenant enterprise environments. The 160 million concurrent sessions figure is useful for large NAT tables, guest networks, service provider traffic, and busy application stacks where session churn can be higher than the user count suggests.

In UAE projects, the FG-3960E is usually discussed for Equinix DX1/DX2, Khazna, Gulf Data Hub, bank HQs, government facilities, airport-linked infrastructure, and large free-zone operators. It also fits large hospitality and healthcare groups when several properties feed into a shared data centre firewall cluster. Etisalat and du WAN links can scale quickly; firewall inspection capacity needs to be planned before the circuit upgrade, not after the provider hands over the new port.

Buying FG-3960E today? Check the refresh path before approval

The FG-3960E is an E-Series data centre firewall. Some buyers still need it for like-for-like replacement, lab matching, HA expansion, or a spare unit for an installed base. That’s fine. But for a fresh Dubai deployment, the refresh path should be part of the conversation before the purchase order is released.

The nearest newer FortiGate comparison should be checked by requirement, not by model number alone. Look at inspected throughput, 100G port count, VDOM requirement, power feed, rack space, FortiGuard term, and FortiAnalyzer log volume. For many enterprise refresh projects, the discussion moves toward newer high-end F-Series or G-Series FortiGate models where port layout, threat protection throughput, and lifecycle support line up better with a new 3-year or 5-year project window.

Still, installed-base buyers are different. If your current design already uses FG-3960E units, an additional appliance may be needed for HA replacement, spare stock, or a staged migration. In that case, match the exact model, power type, transceiver design, FortiGuard term, and FortiOS train used by the environment. Small mismatch. Big maintenance window pain.

What’s in the box

A standard FG-3960E hardware shipment normally includes the FortiGate appliance, power supplies according to model type, rackmount hardware, and basic documentation. For DC model orders, confirm the power feed requirement before invoicing. For HA pairs, order both appliances together where possible so project records, licence terms, and support dates stay aligned.

Transceivers, DAC cables, fibre patch leads, FortiGuard subscription, FortiCare service, FortiAnalyzer, and professional deployment work are normally separate line items. The same applies to QSFP28 optics for 100G uplinks and SFP+ optics for 10G connections. In data centre projects, optics and cable lengths can delay go-live more often than the firewall itself.

Related FortiGate models for UAE projects

The right FortiGate depends on inspection throughput, port mix, rack space, and FortiGuard term. For a full range view, start with the FortiGate firewall Dubai page, then compare the data centre models below.

Dubai and UAE deployment notes

Dubai firewall projects often have two separate pressures: bandwidth growth and audit pressure. Bandwidth comes from data centre interconnects, cloud access, Etisalat/du WAN upgrades, guest WiFi aggregation, branch VPN, and backup replication. Audit pressure comes from DIFC, DMCC, healthcare, government, hospitality, and free-zone security requirements where logs, segmentation, and inspection policies must be easy to explain.

The FG-3960E can sit at the data centre edge, between tenant VLANs, in front of hosted workloads, or behind upstream routers as a high-capacity inspection point. For JAFZA and DAFZA environments, it can support warehouse offices, remote yards, HQ access, and hosted applications through one controlled policy set. For hotel groups, it can separate guest, payment, staff, CCTV, and back-office networks without pushing everything through a small branch firewall.

Power and cooling need attention. A 5U appliance with high heat output belongs in a proper rack with front-to-back airflow and clean cable management. Dubai facilities may have good cooling, but wasted kW still shows up in monthly operating cost. That’s why the sizing conversation should include rack space, optics, FortiGuard term, FortiAnalyzer logging, HA failover load, and the next WAN upgrade already on the roadmap.

Africa, GCC and MEA export from Dubai

Vector Digital Systems supports FG-3960E export enquiries for enterprise and service provider projects across Saudi Arabia, Qatar, Oman, Kuwait, Bahrain, Egypt, Kenya, Nigeria, South Africa, and Jordan. FOB Dubai pricing is available for hardware, HA pairs, FortiGuard licensing, and project quantities. For cross-border projects, share the exact model, AC or DC power requirement, FortiGuard term, and optics list before quoting. That avoids customs delays, wrong power feeds, and missing transceivers at installation.

FG-3960E buyer FAQ

What is the threat protection throughput on the Fortinet FG-3960E?

The FG-3960E delivers 13.5 Gbps threat protection throughput. Its raw firewall throughput is 620 Gbps. Use the 13.5 Gbps figure when sizing IPS, application control, antivirus, and threat inspection traffic.

Does the FG-3960E support HA?

Yes. The FG-3960E supports Active-Passive, Active-Active, and clustering. For Dubai data centre and enterprise edge deployments, most buyers should size it as an HA pair so one unit can carry traffic during failure or maintenance.

What FortiGuard bundles are available for FG-3960E?

UTP Bundle and Enterprise Bundle options are available in 1-year and 3-year terms. UTP includes IPS, Application Control, Web Filtering, Antivirus, FortiSandbox Cloud, and Botnet protection. Enterprise adds FortiCASB, FortiConverter, Industrial Security, and IoT Detection.

What is the FG-3960E form factor?

The FG-3960E is a 5U rackmount firewall. It needs proper rack depth, front-to-back airflow, structured fibre patching, and power planning. It is built for data centre and carrier environments, not small branch racks.

How many VDOMs does the FG-3960E support?

The FG-3960E supports 10 default VDOMs and up to 500 maximum VDOMs with the right licensing and configuration. That makes it useful for multi-tenant, MSSP, and segmented enterprise environments.

Can the FG-3960E work with Etisalat and du WAN links?

Yes. The FG-3960E can be used with Etisalat Business and du Enterprise WAN links, including high-capacity uplinks through 10G SFP+ and 40/100G QSFP+/QSFP28 interfaces. Match optics, routing design, and inspected throughput before circuit handover.