·9 min read

Fortinet Enterprise and UTP bundles, explained

If you've ever looked at a Fortinet quote and seen line items like FG-60F-BDL-950-36 or FG-100F-BDL-809-60, this guide is for you. The -BDL- suffix is the bundle, the next number identifies which bundle, and the trailing number is the term length in months.

Bundles are how Fortinet packages hardware + multi-year support + multi-year security subscriptions into a single SKU. Buying the bundle is almost always cheaper than buying each piece separately, and it dramatically simplifies budget planning because everything renews on the same date.

Here's how to read them, when to pick which bundle, and how to pick a term length.

The two bundle families

Firewall Junction stocks two bundle types for most Fortinet hardware:

UTP — Unified Threat Protection bundle (-BDL-950)

Covers the core security services that turn a FortiGate from a stateful firewall into an NGFW:

  • FortiCare hardware support (RMA, firmware updates, technical assistance)
  • Antivirus signature updates
  • IPS (Intrusion Prevention) signature updates
  • Web filtering categories
  • Application control signatures
  • Anti-spam (where applicable)

If you bought a FortiGate to actually use its security features — IPS, AV, web filtering — you need UTP at minimum. Without it, the box still routes traffic, but the signatures it inspects against are frozen at the day you bought it.

Enterprise — full subscription bundle (-BDL-809)

UTP plus the higher-tier services:

  • Everything in UTP
  • SD-WAN orchestration / Secure SD-WAN add-ons
  • FortiSandbox cloud (zero-day file detonation)
  • FortiCASB / cloud security posture
  • Advanced threat protection feeds
  • Premium FortiCare (faster SLAs)

The Enterprise bundle is the right pick when you're running multi-site SD-WAN, when you want zero-day file analysis, or when the SLA upgrade for FortiCare matters because the firewall is on a critical path.

The pricing math

Both bundles price as a percentage of the base hardware cost, depending on term length:

| Term | UTP (-BDL-950) | Enterprise (-BDL-809) | |---|---|---| | 1 year | 25% of hardware | 30% of hardware | | 3 years | 62% of hardware | 75% of hardware | | 5 years | 99% of hardware | 120% of hardware |

A few things jump out of that table:

3-year is the sweet spot for most buyers. Three years of UTP costs 62% of hardware — versus three separate annual buys at 25% × 3 = 75%. You save ~13 points just by committing to the longer term up front, and you lock in pricing against subscription cost increases.

5-year doubles down on the savings. Five years of UTP at 99% of hardware versus five separate annual buys at 125% of hardware. Even bigger discount, plus zero subscription-management overhead for half a decade.

Enterprise vs UTP is a ~10 point premium. At 3-year terms, Enterprise costs 75% vs UTP's 62% — a 13-point delta. Worth it if you'll actually use the SD-WAN orchestration, sandbox, or premium FortiCare. Not worth it if those features just sit unused.

Working an example

Say you're buying a FortiGate 60F for a 30-person office. Base hardware: ~$650. Three options for support + subscriptions:

| Choice | Year 1 cost | Year 2-3 (renewal) | 3-year TCO | |---|---|---|---| | Hardware + no bundle | $650 | DIY each year | $650 + risk | | Hardware + 3yr UTP | $650 + ~$403 | $0 | ~$1,053 | | Hardware + 3yr Enterprise | $650 + ~$488 | $0 | ~$1,138 |

The 3-year UTP bundle costs about $400 more than the bare appliance but covers three full years of signature updates and support. For most SMBs, that's the natural default.

How to decide what to buy

Five questions, in order:

  1. Will you use Fortinet's security services? (IPS, AV, web filtering) → Yes for almost everyone. Skip ahead.
  2. Will you run multi-site SD-WAN, FortiSandbox, or do you need premium SLAs? → Pick Enterprise. Otherwise, UTP is enough.
  3. How long do you plan to keep this firewall? → Match the bundle term. 3 years is the standard; 5 years if you want maximum lock-in savings; 1 year only if you're piloting or expect to replace soon.
  4. What's your budget cycle? → If your company budgets annually, a 3-year prepaid bundle is sometimes harder to expense. UTP-1yr is the compromise.
  5. Is the box on a critical path? → If outages are expensive, add the Enterprise bundle for faster FortiCare response.

Reading a bundle SKU

The format is: {hardware-SKU}-BDL-{bundle-id}-{term-months}

Examples:

  • FG-60F-BDL-950-36 → FortiGate 60F + UTP bundle + 36 months (3 years)
  • FG-100F-BDL-809-60 → FortiGate 100F + Enterprise bundle + 60 months (5 years)
  • FG-200F-BDL-950-12 → FortiGate 200F + UTP bundle + 12 months (1 year)

When you see a quote, scan the suffixes — they tell you exactly what's covered for how long.

Renewals

When a bundle expires:

  • The hardware keeps working. It's not bricked.
  • Signatures stop updating. Your IPS database is frozen at expiry day. Your AV database is frozen at expiry day. You're protected against yesterday's threats, not today's.
  • No firmware updates or technical support.

For active deployments, you renew the bundle before expiry. The renewal SKU is typically the same -BDL- SKU as the original, with a fresh term — and renewal pricing tracks the same percentage-of-hardware math.

Next steps

  • For a guided quote that surfaces the right hardware + bundle in one pass, use the AI Security Advisor on the homepage.
  • Browse Fortinet hardware — bundle options appear on each product detail page.
  • For enterprise orders (subtotal $3,000+), a dedicated account manager will review bundle selection with you before quoting — useful when you're comparing 3-year UTP versus 5-year Enterprise across a multi-site rollout.
← More buyer's guidesBrowse the catalog