FortiGuard Renewal Audit: 15 Checks Before You Sign the Quote
Published 12 Oct 2026
· By
Pawan Sharma
· Network Security
· 10 min read
The FortiGuard renewal quote lands in procurement two weeks before expiry. It has a dozen SKUs nobody on the finance side can read, a total that looks roughly like last year's, and an urgent note from the partner that protection lapses on the 30th. It gets approved. Nobody checks whether the serial numbers are right, whether the bundle is the same tier you had, or whether one of the firewalls on the quote reaches end of support halfway through the term.
Renewals are where most FortiGate money is spent over a device's life — and where the least scrutiny happens. Below are the fifteen checks our renewal desk runs before we quote, grouped into four areas. They pair with a free FortiGuard Renewal Audit worksheet (Excel): one row per device, with columns for what you have today, what the quote says, and whether they match.
🗂️ Group 1
Inventory
Is this the right list of boxes?
📦 Group 2
Entitlements
Same protection as today?
⏳ Group 3
Lifecycle
Will the box outlive the term?
🧾 Group 4
Commercials
Dates, terms, line-items
The Three Traps We See Most
Silent bundle downgrade
You have UTP today. The quote says "FortiGate bundle, 3 years" and the SKU is ATP. Web and DNS filtering stop on renewal day, and nobody notices until an audit.
Support tier drop
The FortiCare line changes tier between years. The total barely moves, but your response commitment on a critical outage does.
Renewing a dying box
Three years of subscriptions get added to a model that reaches end of support in eighteen months. You pay for entitlements you can't use.
Group 1 — Inventory (4 checks)
Start from your asset list, not the partner's
Renewals are per serial number
Fortinet entitlements attach to a device serial number. A quote is only as correct as the serial list behind it. Pull your own list from FortiCloud → Asset Management before you open the quote.
01Every serial on the quote exists in your FortiCloud account — and every live device in your account is on the quote.
Missing devices lapse silently; extra serials (an RMA'd unit, a box returned to the lab) are money for nothing.
02Both members of every HA pair are covered with matching services.
Each unit in a FortiGate HA cluster needs its own licences. A mismatch shows up the day the secondary takes over and starts enforcing less than the primary did.
03Devices due for replacement in the next 12 months are flagged before quoting.
If a branch is closing or a refresh is approved, renew those units for one year or not at all — not for three.
04FortiGate-VM licences match the vCPU count actually deployed.
VM licences are tiered by vCPU. Over-licensed VMs are common after a cloud right-sizing that nobody told procurement about.
Group 2 — Entitlements (5 checks)
Same protection, or deliberately different
Compare tier to tier, not total to total
The bundle hierarchy is ATP ⊂ UTP ⊂ Enterprise — each includes everything in the one below. On the device, System → FortiGuard shows what is licensed today; FortiCloud shows the same per serial with expiry dates.
05The bundle tier on the quote is named, and it matches what you have today — or the change is a decision you made.
Moving from UTP to ATP can be the right call if web and DNS filtering are handled elsewhere. It should never be a surprise.
06The FortiCare tier (Essentials, Premium, Elite) is the same as today and the same in every year of the term.
Read the current Fortinet service description for each tier's response targets and decide which one your critical sites need.
07No à-la-carte services duplicate what the bundle already includes.
A separate web-filtering or IPS line on top of a UTP bundle is paying twice. So is a standalone FortiCare line when the bundle SKU already includes support.
08Licensed features are actually in use — or there's a plan to use them.
If web filter, DNS filter and application control are off on every policy, you're renewing UTP and using ATP. Our 40-point audit checklist shows how to check.
09Companion products renew alongside the firewalls — FortiAnalyzer, FortiManager, FortiToken, FortiClient EMS, cloud logging.
A FortiAnalyzer licence that lapses a month after the firewalls means a month of logs you can't search, and a CERT-In retention gap.
Group 3 — Lifecycle (3 checks)
Don't buy a term the hardware can't serve
Check the end-of-support date for every model
Fortinet publishes End of Order (EOO), Last Service Extension (LSE) and End of Support (EOS) dates for each model on its support portal's Product Life Cycle page. Match each model on the quote against it.
10No device is renewed for a term that runs past its End of Support date.
Once a model reaches EOS, there are no more firmware fixes or hardware replacement — whatever the contract says.
11Models past End of Order have a refresh plan priced next to the renewal.
Compare "renew the old box for three years" against "replace it now with a current model and its bundle". The second is often closer in cost than expected, and resets the lifecycle clock.
12The device can run a FortiOS release that is still supported and patched.
Older or smaller models can be capped at an older FortiOS branch. A valid subscription on a firmware branch that no longer gets security fixes is not protection.
Group 4 — Commercials (3 checks)
Read the dates, not just the total
Itemised, dated and comparable
13The quote is itemised per serial with start and end dates for each line.
A single lump-sum line hides tier changes, missing devices and markup. Ask for the SKU, serial, term and dates on every line.
14Start dates follow on from your current expiry — and a lapse doesn't buy you free time.
Renewals typically run from the previous expiry date, not the day you pay. Renewing late usually means paying for the gap while having had no protection during it.
15Multiple expiry dates are being brought onto one anniversary where it makes sense.
Ten firewalls renewing in ten different months means ten approvals and ten chances to lapse. Ask your partner whether co-terming onto a single date is possible at this renewal.
When to Start
Run this audit 60 days before the earliest expiry. That leaves time to correct the serial list, get a second quote, decide on any refresh, and raise the PO without the "it lapses on Friday" pressure that makes every renewal look urgent. For a single firewall it takes about 30 minutes; for a multi-site estate, budget an afternoon with the worksheet.
✅ Key Takeaways
- Start from your own serial list. FortiCloud Asset Management, not the partner's spreadsheet — and cover both HA members.
- Compare tier to tier. Bundle and FortiCare tier on the quote should match today, or be a change you chose.
- Don't pay twice. Watch for à-la-carte lines that the bundle already includes.
- Check end-of-support dates. Never renew past EOS; price a refresh next to any renewal on an end-of-order model.
- Demand per-serial, dated line-items. And start 60 days early so urgency doesn't do the approving.
Download the FortiGuard Renewal Audit Worksheet
List each FortiGate once. Record today's bundle, FortiCare tier, expiry and end-of-support date; paste in the quote line; the sheet flags tier changes, missing serials, duplicate services and renewals that outrun the hardware.
🔥 Authorised Fortinet Partner
Renewal coming up?
Send us your current renewal quote or your FortiCloud asset export. We'll run these 15 checks, flag anything that doesn't match, and quote line-for-line against the same structure — so you can compare us with any other partner on equal terms.
Stay ahead of cyber threats
One short email a week — curated Indian cybersecurity news, Fortinet releases, DPDPA updates. No fluff.
