FortiSandbox Appliance vs FortiSandbox Cloud

FortiSandbox is available as a physical or virtual appliance (FortiSandbox Appliance), or as a cloud advanced threat protection service integrated with FortiGate (FortiSandbox Cloud).

To select the settings for Sandbox Inspection, such as the FortiSandbox type, server, and notifier email, go to Security Fabric > Settings.

The table below highlights the supported features of both types of FortiSandbox:

Feature	FortiSandbox Appliance (including VM)	FortiSandbox Cloud
Sandbox inspection for FortiGate	Yes (FortiOS 5.0.4+)	Yes (FortiOS 5.2.3+)
Sandbox inspection for FortiMail	Yes (FortiMail OS 5.1+)	Yes (FortiMail OS 5.3+)
Sandbox inspection for FortiWeb	Yes (FortiWeb OS 5.4+)	Yes (FortiWeb OS 5.5.3+)
Sandbox inspection for FortiClient	Yes (FortiClient 5.4+ for Windows only)	No
Sandbox inspection for network share	Yes	No
Sandbox inspection for ICAP client	Yes	No
Manual File upload for analysis	Yes	Yes
Sniffer mode	Yes	Yes
File Status Feedback and Report	Yes	Yes
Dynamic Threat Database updates for FortiGate	Yes (FortiOS 5.4+)	Yes (FortiOS 5.4+)
Dynamic Threat Database updates for FortiClient	Yes (FortiClient 5.4 for Windows only)	Yes (FortiClient 5.6+ for Windows only)

Note that FortiMail keeps its own Dynamic Threat Database. For more information, see the FortiSandbox documentation.