FortiExtender
Secure 5G and LTE gateways that bring wireless WAN to FortiGate deployments: carrier failover, primary connectivity for new sites, out-of-band management, and LAN extension. Managed by the FortiGate, FortiEdge Cloud, or standalone.
Overview
FortiExtender is Fortinet's secure wireless WAN gateway line. It connects a site to 5G or LTE and hands that connectivity to a FortiGate as a WAN link, a failover path, or an extended LAN segment, with the FortiGate's security policies applied to the traffic. Deployment modes include FortiGate-managed, FortiEdge Cloud-managed, and standalone.
The current line has 12 models in the InManDis catalog: the WAN series (FortiExtender 50G, 101G, 201F, 202F, 211G, 511G, and 511G-WiFi, plus the Ethernet-only 200F LAN extender), the Vehicle series (211F, 212F, and 511G, with GNSS for fleet use), and the Rugged 511G for harsh environments. Models differ by modem and bands, SIM count, Ethernet ports, PoE, and IPsec throughput; compare them side by side from the Docs & downloads section below.
Architecture
In the common design, the FortiGate manages the FortiExtender through its extension controller: the extender is discovered, authorized, and configured from a FortiExtender profile on the FortiGate, and its cellular link shows up as a WAN interface for SD-WAN and policy routing. A LAN extension mode builds a VXLAN-over-IPsec tunnel so remote devices sit on the FortiGate's LAN.
FortiExtenders can also run standalone or under FortiEdge Cloud management, support active/active load sharing and VRRP between units, and use split tunneling so only selected traffic crosses the cellular link.
Common use cases
| # | Use case |
|---|---|
| 1 | Carrier failover when the wired WAN link goes down |
| 2 | Primary 5G/LTE connectivity for new, temporary, or pop-up sites |
| 3 | Out-of-band management path to remote network gear |
| 4 | Vehicle and fleet connectivity (Vehicle series, GNSS tracking) |
| 5 | Rugged and OT sites where wired WAN is impractical |
| 6 | LAN extension: remote devices on the FortiGate LAN over VXLAN/IPsec |
Configuration focus
- Management mode: FortiGate extension controller, FortiEdge Cloud, or standalone.
- FortiExtender profile on the FortiGate: modem, SIM, and data-plan settings.
- SIM and APN configuration per carrier, including dual-SIM failover.
- Antenna placement and signal quality before final mounting.
- SD-WAN membership and failover rules for the cellular link.
Validate carrier bands and the data plan against the exact model before deployment. Cellular behavior varies by region and carrier in ways wired WAN links do not.
Troubleshooting framework
| Area | What to validate |
|---|---|
| Cellular | SIM active, APN correct, signal strength and band, carrier account in good standing. |
| Registration | Extender discovered and authorized by the FortiGate extension controller or cloud. |
| Throughput | Signal quality and placement, carrier throttling or plan limits, modem firmware. |
| Failover | SD-WAN rules and link health checks actually fail traffic over and back. |
Official documentation & downloads
Lifecycle
Use lifecycle search for end-of-order, end-of-support, and last-service dates, plus the recommended replacement model.