Fortinet FortiDDoS: Architecture, Capabilities and Trade-offs

Best for: enterprises already standardised on the Fortinet Security Fabric

FortiDDoS is frequently evaluated for a reason that has little to do with its own specifications: an estate that already runs Fortinet firewalls and analytics can add this layer inside an operational model it already has. That is a real advantage and it deserves to be weighed as one, alongside what a single-supplier path costs.

At a glance

Appliance	Value	Evidence
Manufacturer	Fortinet	Vendor-stated
Category	On-premises appliance	Vendor-stated
Deployment	Inline; other modes not verified for this profile	Partly verified
Documented design centre	Hardware-accelerated inspection with machine-learned behavioural baselines	Vendor-stated
Own global scrubbing cloud	Not verified for this profile	Unknown
Published capacity figures	Not reproduced here — model-specific, check the current datasheet	Not verified for this profile
Best-fit environment	Estates already standardised on Fortinet	Editorial inference

Architecture

An on-premises appliance that inspects traffic at line rate on Fortinet’s custom processors Fortinet Fortiddos. It is a distinct product rather than a firewall feature, which matters for the most common objection raised against it — that a stateful device is the wrong tool for state exhaustion. The objection applies to firewalls performing flood defence as a feature; whether it applies here is a question for a test bench.

Detection and classification

Behavioural baselines built with machine learning rather than primarily signature matching. As with any learned baseline, the evaluation questions are how long the learning window is, how the baseline handles seasonality, and what happens when the business changes shape faster than the model does.

Layer 3 and Layer 4 mitigation

The hardware-accelerated path is the documented strength. What a buyer needs from it is a packet-rate figure at a stated packet size for the specific model, not a family-level bit-rate number.

Layer 7 mitigation

Included in the product’s scope. Depth relative to purpose-built application-layer designs is not verified for this profile and is exactly what a proof of concept should measure with replayed application traffic.

Capacity and packet-rate considerations

Not reproduced here. Take model-specific figures from the current datasheet, and require both bit rate and packet rate with the packet size stated.

Multi-tenancy

Not verified for this profile. Service providers should establish per-customer policy separation and reporting against the quoted model.

HA, bypass and failure modes

Inline placement makes these first-order questions. Establish the bypass mechanism and whether it is hardware or software, the behaviour on power loss and software fault, and the measured failover time.

Management and telemetry

Shared management with the rest of the Fortinet estate is the stated operational advantage. For evidence purposes, establish what is retained locally, in which formats it exports, and whether an incident report can be built from data you hold.

Data and control-plane dependencies

Not verified for this profile. Where the product consults any manufacturer-operated service, the questions are the standard ones: what leaves the network, where it is processed, and how protection degrades if the service is unreachable.

Integrations

Integrates with the broader Fortinet portfolio, which is the principal reason it appears on shortlists. Third-party integration breadth is not verified for this profile.

Regional support

Not verified for this profile, though Fortinet’s support footprint is among the broader ones in this category. Establish the out-of-hours arrangement in your market specifically.

Licensing and TCO characteristics

The single-vendor model tends to simplify the commercial picture, and simplification cuts both ways: fewer relationships to manage, and less leverage at renewal because more of the estate depends on one negotiation. Price the five-year profile with that in mind.

Strengths

Purpose-built silicon rather than general-purpose inspection. Learned baselines rather than signature dependence. A genuine operational saving for estates already standardised on the vendor, which for a small team can matter more than a specification difference.

Limitations and unknowns

• Application-layer depth relative to purpose-built designs is unverified and should be tested.
• Multi-tenancy, cloud dependencies, deployment modes and current model capacities were not verified for this profile.
• The single-supplier advantage is also a concentration; whether that is acceptable is an architecture decision rather than a product one.

Best fit

Fortinet-standardised estates that want DDoS coverage inside an operational model they already run, and teams whose constraint is people rather than budget.

Poor fit

Deliberately multi-vendor architectures, and buyers whose primary problem is application-layer depth and who would be choosing on ecosystem fit rather than on measured coverage.

POC questions

1. Sustain a state-exhaustion attack and measure goodput on legitimate sessions throughout.
2. Run a multi-vector campaign rather than one class at a time.
3. Replay your own application traffic alongside a Layer 7 attack and measure the false-positive rate.
4. Test at 64-byte packets and record where behaviour changes.
5. Establish what the appliance does if any manufacturer-operated service is unreachable.
6. Price the five-year renewal for this layer separately from the rest of the estate, so the bundled figure does not hide it.

Sources