Do You Need a ZTNA License for FortiGate? What You Already Own in 2026

A ZTNA proposal arrives in your inbox. Meanwhile, the FortiGate in your rack was purchased several years ago.

So, do you actually need to buy another product to enable ZTNA?

The important part is understanding exactly what your existing Fortinet investment already provides.

Is ZTNA Already Included in FortiOS?

Yes. The ZTNA Application Gateway is built into FortiOS and does not require a separate license.

According to Fortinet's Universal ZTNA Ordering Guide, the gateway is supported across FortiGate platforms running FortiOS 7.0 and later.

That means your existing FortiGate already provides capabilities such as:

• Application-level segmentation that limits users to specific services rather than the broader network

• Identity and device-posture checks for individual sessions

• SAML-based single sign-on

• HTTPS forwarding for web applications

• TCP forwarding for RDP, SSH and Telnet

• Server load balancing, including hardware acceleration on supported FortiGate models

There is also an important distinction here: ZTNA is not locked behind the UTP or Enterprise bundles.

Those bundles primarily add FortiGuard services such as antivirus and web filtering. The ZTNA gateway itself can still operate on a FortiGate without an active FortiGuard subscription.

Do I Need to License ZTNA on FortiGate or FortiClient?

The additional ZTNA licensing requirement is on FortiClient, not the FortiGate acting as the ZTNA gateway.

Fortinet's FAQ states that customers purchase the FortiClient ZTNA license and do not need another ZTNA-specific license for the FortiGate gateway.

The architecture explains why.

FortiClient EMS manages the endpoint certificates and posture policies. FortiGate performs the enforcement, while the endpoint uses its certificate to establish its identity.

So if a quotation contains a separate ZTNA charge against your FortiGate, ask the reseller to explain exactly what that line item provides.

Which FortiGate Models Support ZTNA?

FortiGate platforms running FortiOS 7.0 or later support ZTNA.

This is not limited to the newest hardware generations or specific licensing bundles.

To check your current environment, open:

System → Firmware

and confirm the FortiOS version installed on your appliance.

ZTNA is also available beyond physical FortiGate appliances. If your applications are hosted in public cloud environments, the ZTNA Application Gateway can be deployed as a standalone virtual machine through the Azure and AWS marketplaces.

That means a physical FortiGate does not necessarily have to sit directly in the application access path.

Does a FortiClient EPP License Already Include ZTNA?

Yes — and this is one of the first things you should verify before purchasing additional licenses.

Fortinet states that the FortiClient EPP license includes ZTNA entitlements, allowing organisations to combine secure remote access with endpoint protection through the same agent.

This matters because some organisations already have the necessary entitlement but still receive a separate ZTNA quotation.

Before approving another purchase, check your existing FortiCare contracts.

If FortiClient EPP is already deployed, you may already have ZTNA coverage for those endpoints.

FortiClient ZTNA vs. EPP/APT: What Changes?

The simplest way to look at the tiers is:

ZTNA focuses on secure access, while EPP and APT add endpoint-security capabilities on top of that access layer.

You do not necessarily need to put every endpoint on the same tier.

EMS supports mixed deployments. For example, corporate laptops can use EPP while contractor endpoints receive ZTNA-only licensing.

That can be considerably more economical than assigning the highest tier to every device.

ZTNA also supports iOS and Android web-application access through FortiClient and EMS 7.2.2 onward when EMS is integrated with an MDM platform.

What Does Fortinet ZTNA Cost?

Based on the pricing figures in the source material, list pricing is approximately $31 per endpoint annually for a 25-seat deployment, dropping to around $14 per endpoint at 500 endpoints.

Fortinet does not directly publish these prices; the figures come from authorised reseller listings and represent current cloud-hosted EMS, one-year list pricing.

There are two pricing factors worth paying attention to during procurement.

Pack size can make a major difference

The larger the license pack, the lower the effective cost per endpoint.

Moving from a 25-endpoint pack to a 500-endpoint pack reduces the per-user ZTNA rate by roughly 55%.

If your actual deployment is close to the next licensing threshold, ask the reseller to quote both options. A larger pack may increase the total price only modestly while giving you substantially more licenses.

Longer terms do not automatically mean a list-price discount

The 500-endpoint ZTNA license is listed at:

• 1 year: $6,936

• 3 years: $20,808

• 5 years: $34,680

Those figures are exactly three and five times the annual price.

So a longer contract primarily provides price certainty at list pricing. Any actual multi-year discount would need to come through negotiation.

Street pricing can also be lower than list. One reseller listing, for example, showed a 25-endpoint ZTNA pack at $663 compared with a $768 list price.

What Indian buyers should consider

These figures are in USD and represent list pricing. Actual Fortinet pricing in India will depend on distribution, reseller discounts, exchange rates and your negotiated commercial terms.

A five-year commitment also creates longer-term currency exposure in addition to locking in your endpoint commitment.

Use the security cost calculator to establish a baseline before approaching a vendor or reseller.

Pricing figures were verified against authorised reseller listings in August 2026. Confirm current pricing before using these numbers for budgeting or procurement.

What Is the Minimum Number of ZTNA Licenses?

The minimum pack is 25 endpoints.

The available packs are:

• 25

• 500

• 2,000

• 10,000

If your organisation has fewer than 25 users requiring ZTNA, the minimum purchase remains a 25-endpoint pack.

Cloud EMS or On-Premises EMS: Which One Should You Choose?

The licensing identifiers differ depending on where EMS is hosted.

Cloud EMS uses EMS05 part numbers, while on-premises EMS uses EMS04.

With cloud-hosted EMS, Fortinet operates the management infrastructure, which can simplify deployment and reduce the infrastructure your team has to maintain.

On-premises EMS keeps the management server and associated data within infrastructure controlled by your organisation. That can be particularly relevant for BFSI, government environments and organisations with specific data-residency requirements in India.

For EPP and APT, the source material specifies replacing 428 with 429 in the relevant part number.

When reviewing a quotation, compare the proposed SKU against these identifiers so you can confirm that the quoted license matches the deployment you actually requested.

How Can You Check Your Existing ZTNA Entitlements?

Before purchasing anything, work through these four checks.

1. Verify your FortiOS version

Go to:

System → Firmware

If the FortiGate is running FortiOS 7.0 or later, the ZTNA gateway functionality is already included.

2. Review your existing FortiClient contracts

Open the FortiCare support portal and inspect your current entitlements.

If you already have EPP or APT licensing, check whether ZTNA is included.

3. Compare licensed and deployed endpoints

Do not assume your current contract matches today's headcount.

A license agreement created several years ago may have been sized around a different number of employees or devices.

4. Check your EMS deployment

If you already operate on-premises EMS, determine whether your existing environment requires only an entitlement or license uplift rather than a completely new deployment.

Send us your FortiGate serial numbers and FortiCare contract details. We can review what ZTNA capabilities you already have and identify what, if anything, still needs to be purchased. Request a free license entitlement review.

ZTNA Over VPN vs. Full ZTNA: Which Is Cheaper to Start?

The licensing can be the same. The implementation effort is not.

Fortinet supports two adoption approaches, and the distinction is important when planning a migration.

ZTNA over VPN

You retain the existing VPN and introduce FortiClient posture tags.

FortiGate policies can then evaluate the device's security posture alongside the user's identity before allowing access.

This provides meaningful posture-based controls without immediately redesigning application access around the ZTNA Application Gateway.

Full ZTNA

The organisation deploys the ZTNA Application Gateway and moves toward application-level access with per-session and continuous verification.

Users no longer receive broad network-level access simply because they have authenticated.

If you are facing an SSL VPN deadline, starting with ZTNA over VPN can be a sensible transition stage rather than something you need to avoid.

We cover that decision in FortiOS 7.6.3 Removed SSL VPN Tunnel Mode: Your Migration Options, while the implementation sequence is covered in How to Migrate from FortiGate SSL VPN to ZTNA.

Three Questions to Ask Before Signing the Quote

Before approving a Fortinet ZTNA proposal, ask these three questions.

1. What exactly is the FortiGate-side ZTNA charge for?
The ZTNA gateway itself is included with FortiOS.

2. Were our existing FortiClient entitlements checked?
Existing EPP contracts may already include the ZTNA entitlement you need.

3. Does the proposed tier match our actual deployment?
Paying for endpoint-security capabilities that your users do not require is one of the easiest ways to inflate the project cost.

In many environments, the final licensing position falls somewhere between already covered and requiring a relatively small endpoint-license uplift.

A full, additional ZTNA purchase is not automatically necessary simply because a ZTNA project is being proposed.

NetNXT is a Fortinet partner and reviews Fortinet licensing positions for organisations across India—including situations where the correct recommendation is that additional licensing is not required.

Send us your entitlement details for a licensing review, or begin with a zero trust assessment if the bigger question is how ZTNA should fit into your security architecture.

If you are evaluating alternatives, Top 10 ZTNA Solutions in India compares other platforms based on fit and pricing.