Does the FortiGate speed test measure my firewall throughput?

No. The built-in speed test measures the link speed on a single interface, usually WAN to internet. It does not push traffic through your firewall policies, so it will not show an inspection bottleneck. To measure real throughput, run an iPerf3 test through the FortiGate with your production IPS and SSL inspection profiles applied.

Why is my FortiGate throughput much lower than the datasheet?

The headline firewall throughput is measured with large 1518-byte packets and no inspection. Once IPS, application control, and especially SSL inspection are enabled on a realistic traffic mix, usable throughput drops sharply. For sizing, use the threat-protection and SSL-inspection figures, which are far closer to real life.

What CLI command runs a speed test on a FortiGate?

Use execute speed-test , or diagnose netlink interface speed-test {Auto | TCP | UDP} for an explicit server and protocol. Tune it first with config system speed-test-setting (latency-threshold and multiple-tcp-stream). The SD-WAN monitor capability must be licensed and reachable.

How do I know when I have outgrown my FortiGate?

When the CPU is consistently high under real inspected traffic and tuning no longer helps. If diagnose sys top shows ipsengine or wad saturating the CPU and an iPerf3 test with SSL inspection lands well below your internet plan, the firewall is the ceiling. Price the current G-series, which delivers roughly 2 to 3 times the threat-protection throughput of the F-series.