We're looking for changing firewall vendors. Nothing huge, a couple of HA pairs, a few gbps of throughput per pair. If you were to pick between Fortinet or Palo Alto, which would you pick and why?
Posted Apr 26, 2022, 6:23 PM UTC
Palo Alto if you can afford it, Fortinet if you can't is the general wisdom.
Palo Alto, all the way with me.
Fortinet is also very good. You can't go wrong with either one. Just make sure you size them correctly. They're usually quoted a little lower on the specs to make the price more enticing.
Fortinet devices are great, support is OK.
PA.
We just moved to Fortinet. No complaints.
Everyone is telling me what they'd pick, but not why. I'm looking to articulate why we shoudl pick one over the other.
Hell if we know. You haven’t provided any requirements.
(1) Name recognition / Status symbol. This is similar to people telling you to buy an iPhone. It's not really about user experience. It's about name and status.
(2) PA has a more elegant web interface. Fortinet's web interface can be a little clunky.
Beyond this, honestly, both are roughly equal. Fortinet's price-per-performance is one of, if not the, best in the business.
Nailed it!
[deleted]
Quantify that statement, please.
Palo alto is second to none as far as security goes. They're hands down the best NGFW on the market. Support has gotten......worse over the years but so has everyone's. Fortinet makes some good stuff, but they're not in the same league.
If you've got the money, PAN all day every day.
If you want to do right by the business Fortinet wins every time (price/performance). Strong security efficacy with more $ spent on things that matter (Not sales and marketing). Little known fact more Fortigates on the planet than any other FW (used by most large telcos). Sales and marketing isn’t great, but that means you’re paying for the parts that matter.
Cost is not value. Doing right by the business is getting the solution that has the highest value. That varies, but cost per Mbps is rarely a consideration. Our network team is 15 guys supporting 60 offices, we know PAN and FTD. You could give us fortinet gear with a bag of cash in top and it would be the worst value imaginable, as we have none of it, and no skills for it.
How is your experience with FTD ? We are considering Fortinet upgrade fr Asa , but I have a hard time trusting anything else but AnyConnect for vpn .
If the team truly understands NetSec learning a new platform is trivial if it saves millions of dollars (mileage will vary based on scale). Acquisition and operational costs are important , but my point is that when you buy the Palos or Ciscos of the world you’re overpaying. Case in point look at the cost of a Cisco branded optic vs the Fs.com equivalent. This market is full of sales and marketing machines that force businesses to pay a huge premium for fairly commoditized technology. Used to work for the 800lb gorilla (all of those expert certs) and have resold everything in the space; don’t let vendor allegiance and religion get in the way of saving your employer money. Your value to the business has absolutely nothing to do with knowing a CLI or GUI and if it does you’re doing it wrong. ;)
Time is money and CapEx isn't the only thing that matters, in fact we don't really care about CapEx here but OpEx.
I've worked at shops where we had nothing but a 10 year old 5505 struggling through, to shops that spent a million dollars a year on firewalls alone. Never once has anyone I've worked with (or for) regretted a single penny we've given to PAN. There are not many vendors I can say that about.
And to be honest I'm sure we are like a lot of big shops, we have one or two really sharp guys and a bunch of not so sharp ones. They do okay on the gear they know but can't get thrown into a new ecosystem
We are deploying both for different parts of our enterprise. We have had more issues and annoyances with PA but that doesn't mean its a bad product. I prefer the Fortinet but I have more experience with it, so that is a huge factor. There is a definite price gap between the two vendors, or at least there used to be. I get the quotes but don't write the checks.
PA.
PA is the closest you'll feel to feeling like luxury.
Fortinet I'd what I'd scale between poor man's sonicwall and PA.
PA. Fortinet is not even in the same league.
FG as I like the WiFi integration as well as the full ecosystem.
Forti for me but I'm biased as a reseller, I have replaced a few palo and in all honesty haven't been impressed.
But I know the forti products pretty well so I might be missing something.
Have both.
Both solutions work well. Support is about the same with both.
Cost is a huge differentiator. The Fortigates blow away the Palos when it comes to price.
Side by side, the Fortigates perform better in my environment. Full decrypt, IPS, web filtering, etc.
I really don't feel you could go wrong with either.
My preference is Fortigate. Just be careful when you take updates (stay away from very new releases unless you absolutely have to upgrade).
PA.
We went with PA because our net admins felt it had the best features, and was more similar to their Cisco backgrounds. Also we have a multi-tenant firewall which PA does great at, but Fortinet does not. Oh and they said that PA support/service is better than Forti. I can't speak to that I've never had to deal with either.
The application based filtering in PAN is second to none. Check out the applipedia. https://applipedia.paloaltonetworks.com/
PAN is good but Check Point seems to be the most comprehensive out of all NGFW solutions.
Good to know, I haven't looked at them.
Just got a quote for some PA 460's and they are bad at all, $4600 ish, list and can bundle the software now. $600ish for the pro package which covers just about all you need license wise. Then you'll just need support. Currently on a PA 3020 that's about to go EOL. PA sales tried to put me in a 3400 series at $30k, guy must have been trying to take his family on vacation, that 400 series seems to be just fine if you don't need to run your fiber right into the thing.
Our quotes are several hundred thousand dollars from Palo Alto and Fortinet at this point.
PA. Not sure what current pricing looks like but few years back the only reason we'd take Forti over PA is price. Forti was "pretty good" but cheaper, PA was "the best" but more expensive.
Both are good choices though.
The cost difference is significant. Our annual M&S was $21,000 on PAN and now it’s $9,500 on a higher spec’d Fortinet.
Hey there , we are also at the choosing state . How did Forticlient go for you . How is the Forticlient vpn client working for you ? If you mind letting me know about client vpn issues .
It’s been good. We have one issue where we are using an ECC cert and there is a bug where that breaks the SAMLD process so we can’t use Azure AD for SSO, but other than that we’ve been happy.
So you still cool even you can’t use SAML for vpn ? :-)
PA is the leader and their products and offerings show it currently. Though I always advise to look at the two and make sure you see the differences. There are remarkable differences with security controls and centralized management of units.