Selling Fortinet to Federal Agencies
How federal purchases of network security actually get made, and where we fit
Most writing aimed at federal buyers is about why a product is good. This page is about how the purchase actually happens, because in federal IT the technical decision is rarely the hard part, the acquisition route is.
There are three broad routes to buying a firewall, and which one applies depends almost entirely on dollar value. Under the micro-purchase threshold a cardholder can simply buy it. Under the Simplified Acquisition Threshold the agency uses simplified procedures. Above that you are into full competition or an existing contract vehicle. Knowing which bracket you are in tells you more about your timeline than any vendor conversation will.
We are not going to pretend that makes us the obvious answer for every purchase. For a large above-SAT programme you will run a competition and the winner will hold a vehicle. Where we are genuinely useful is everything below that line, and as the technical partner behind whoever holds the vehicle above it.
$15,000
Raised from $10,000 effective 1 October 2025. Purchases at or below it can generally be made on a government purchase card without competition.
GSA SmartPay bulletin →$350,000
Raised from $250,000 effective 1 October 2025. Below it, agencies use simplified procedures rather than full-and-open competition.
FAR 2.101 threshold update →The two numbers that decide your route
Both were raised effective 1 October 2025 and both are higher than most people remember. A single branch firewall refresh frequently falls under the micro-purchase threshold outright, and a multi-site rollout often still lands under the Simplified Acquisition Threshold, which means it does not need the procurement effort people assume it does.
Contract vehicles, and being straight about them
GSA Multiple Award Schedule and NASA SEWP are the two vehicles most federal IT hardware moves through. Both require the seller to hold the contract, and both require an active SAM.gov registration with a CAGE code in good standing, plus TAA-compliant products.
If your purchase must go through a vehicle we do not hold, that is not the end of the conversation; it just changes our role. We can support the reseller of record technically, supply the sizing and configuration work, and let the vehicle holder transact. Agencies do this constantly, and a partner who says so plainly is more useful than one who implies a vehicle they do not have.
Compliance questions that stop purchases late
These are the ones that surface after a technical decision is made, which is the expensive time to find them.
- TAA, is the hardware manufactured or substantially transformed in the US or a designated country? Required by GSA Schedule and SEWP.
- Section 889, the prohibition on certain covered telecommunications equipment. Expect to be asked for a representation, and expect it in the contract.
- FIPS 140-2/140-3, validation is tied to a specific firmware version and model. "The vendor has FIPS certification" is not an answer; the version you intend to run is.
- DoDIN APL, listing is per model and per version, and the list changes. Verify the exact model against the current list rather than a vendor summary.
- Section 508, accessibility conformance, evidenced by a VPAT for the specific product.
- Supply chain provenance, increasingly asked for, and a genuine reason not to buy grey-market hardware at any price.
What we will do without being asked
Provide the documentation your contracting officer needs in the form they need it: line-item quotes with part numbers, the manufacturer's compliance documentation, and a written statement of what is and is not included.
Size the firewall honestly, including telling you when a smaller model is sufficient. Under-buying causes an outage; over-buying causes an audit finding. Both are avoidable with an hour of arithmetic before the requisition is raised.
Tell you when we are the wrong route. If the purchase genuinely needs a vehicle we do not hold, we will say so early rather than at the end of a procurement cycle.
Straight answers
Do you hold a GSA Schedule or a SEWP contract?
Ask us directly and we will give you a straight answer rather than a brochure. We deliberately do not list vehicles on this site that we do not hold, because in a procurement context that is not marketing licence; it is a misrepresentation a contracting officer is entitled to rely on. Where a vehicle we do not hold is required, we work with the reseller of record and provide the technical and sizing work.
Can we buy on a government purchase card?
If the total is at or below the micro-purchase threshold of $15,000, generally yes; that covers a substantial share of single-site firewall purchases including a year of support. Above it you move into simplified acquisition procedures. Tell us the ceiling you are working within and we will configure to it rather than quoting past it.
Is Fortinet hardware TAA compliant?
TAA compliance is determined per product and per manufacturing origin, and Fortinet maintains a compliance programme covering it. We will confirm it in writing for the specific part numbers on your quote before you order, which is the only form of that answer worth having, because it is the part number, not the brand, that a contracting officer has to certify.
Which FortiGate models are on the DoDIN APL?
The APL is maintained by DISA and changes as products are listed and delisted, per model and per version. We will not reproduce a snapshot here that goes stale, tell us the models you are considering and we will confirm the current listing status against the live APL, and point you at the entry so you can verify it yourself.
Tell us the constraint you are working within
The vehicle, the threshold, the fiscal year end, the framework you are assessed against. We will build the quote around it rather than around our own quarter.