Fortinet FortiGate Reviews, Competitors and Pricing

Simon Chaba

ICT Manager at a aerospace/defense firm

Jan 25, 2017

Download

Virtual domains are treated as separate firewall instances

Pros and Cons

"You can create multiple Virtual Domains (VDOMs), which are treated as separate firewall instances."
"The reporting you receive out of this appliance is excellent. You will not need an external management system."
"The user interface is relatively easy. The devices are easy to deploy and figure out when you have experience with other security appliances."

"I could not configure sFlow from the FortiGate graphical user interface. I realized that the sFlow configuration is available only from the CLI, and discovered that sFlow is not supported on virtual interfaces, such as VDOM links, IPsec, or GRE."
"There is one big configuration file with no separations for the unique VDOMs. Maybe they could separate individual VDOM configuration files with the root VDOM configuration file referencing the individual VDOM config files."

How has it helped my organization?

There is no need to buy physical firewall hardware when you host multiple customers requiring individual secure access to their FW. You just create virtual domains (VDOMs).

What is most valuable?

You can create multiple Virtual Domains (VDOMs), which are treated as separate firewall instances. The reporting you receive out of this appliance is excellent. You will not need an external management system.

What needs improvement?

1. sFlow and NetFlow

I could not configure sFlow from the FortiGate graphical user interface. I realized that the sFlow configuration is available only from the CLI, and discovered that sFlow is not supported on virtual interfaces, such as VDOM links, IPsec, or GRE.

NetFlow is a network protocol developed by Cisco for collecting IP traffic information and monitoring network traffic. It is not supported on FortiGate for those who have a NetFlow analyzer/collector already setup in their network.

2. Policies

To control traffic in a firewall, you need to create and apply policies to the FW interfaces. By default, policies are sorted by FW interfaces and this makes FW interfaces an integral part of the policies. Zones provide the option to logically group multiple virtual and physical FortiGate firewall interfaces. Then, you apply security policies to those zones (logical groups of interfaces) to control traffic flow on those interfaces.

In a FortiGate unit with a lot of interfaces (including virtual interfaces), there is a high probability of having duplication of policies.

For how long have I used the solution?

Three to five years.

Buyer's Guide

Fortinet FortiGate

November 2024

Free Report: Fortinet FortiGate Reviews and More

Learn what your peers think about Fortinet FortiGate. Get advice and tips from experienced pros sharing their opinions. Updated: November 2024.

DOWNLOAD NOW

816,406 professionals have used our research since 2012.

What do I think about the stability of the solution?

These devices are very stable.

What do I think about the scalability of the solution?

They are easily scalable with multiple built-in interfaces. It supports a minimum of 10 VDOMs. VDOM supports all dynamic routing protocols like RIP, OSPF, BGP, and IS-IS. You do not need to reboot after enabling the VDOMs.

Area for improvement - there is one big configuration file with no separations for the unique VDOMs. Maybe they could separate individual VDOM configuration files with the root VDOM configuration file referencing the individual VDOM config files.

How are customer service and support?

Customer Service:

Customer service is great, an eight out 10.

Technical Support:

I will give technical support an eight out 10.

Which solution did I use previously and why did I switch?

We previously used different solutions as well. We did not switch, we have different requirements for different customers.

How was the initial setup?

The user interface is relatively easy. The devices are easy to deploy and figure out if you have experience with other security appliances.

What about the implementation team?

It was an in-house installation.

What was our ROI?

The ROI is great. These boxes are not that expensive compared to what they can do, their functionality, and the reporting you receive.

What's my experience with pricing, setup cost, and licensing?

Fortinet licensing is straightforward and less confusing compared to Cisco. Fortinet has one or two license types, and the VPN numbers are only limited by the hardware chassis make.

Which other solutions did I evaluate?

I already have experience with Cisco ASA, so it was simply a customer preference and well within the budget.

What other advice do I have?

Great appliances, and it is affordable.

Disclosure: I am a real user, and this review is based on my own experience and opinions.

Simon ChabaICT Manager at a aerospace/defense firm

Report as inappropriate

Jun 10, 2017

Hi Becky. I chose Fortigate mainly because it provides the capabilities to provide logical separate firewall instances to multiple customers. These logical firewall are know as VDOMs. I have the partitions the physical fw devices to multiple logical units thus saving costs.

See all 4 comments

it_user206346

Security Consultant at Webernetz.net - Network Security Consulting

Jul 14, 2015

Cisco ASA vs. Fortinet FortiGate vs. Palo Alto vs. Juniper SSG

Since IPv6 gets more and more important, I am using it by default on all my test firewalls, which of course support IPv6. However, when comparing the different functions and administration capabilities, they vary significantly.

Here comes my short evaluation of the IPv6 functions on the following four firewalls: Cisco ASA, Fortinet FortiGate, Juniper SSG, and Palo Alto.

Criteria

I was merely interested in the basic IPv6 usage and not in the typical firewall categories:

Interface: IPv6 address and link-local address configurable?
Router Advertisement and DHCPv6: Whether the firewalls support nothing (–), only RA (-), DHCPv6 relay (ο), stateless DHCPv6 (+), or stateful DHCPv6 (++). The existence of stateless DHCPv6 is vital for delivering the DNS server IPv6 addresses to the clients. (The “IPv6 Router Advertisement Options for DNS Configuration”, RFC 6106, is not supported by any of these devices.)
Security Policy: Whether IPv4 and IPv6 addresses can be used in the same policy and whether address groups can have objects from both protocols.
Administration: How easy are the IPv6 functions to manage? Only via the CLI (–), fifty-fifty (ο), GUI but complicated (+) , or fully via the GUI (++).

Results

These are the results. They range from — via ο to ++.

	Cisco ASA	Fortinet FortiGate	Juniper ScreenOS	Palo Alto
Version	9.2(3)	5.2.2	6.3.0r18.0	6.1.3
Interface	++	+	++	++
RA, DHCPv6	-	++	+	0
Security Policy	++	-	-	++
Administration	+	-	+	++

Details

Cisco ASA

The Cisco ASA has no DHCPv6 instance running. That is: there is no way to run an IPv6-only network because clients won’t get the DNS server. The security policy is capable of both protocols. Everything is configurable via the GUI, which is not the best at all.

Fortinet FortiGate

The FortiGate is the only firewall with a stateful DHCPv6 server. Great. However, two distinct security policies must be used and nothing of the IPv6 settings are configurable via the GUI. WHAT???

Juniper SSG (ScreenOS)

ScreenOS is dead. However, most of the IPv6 functions are working quite good, except the protocol dependent security policies. Everything is accessible via the GUI, but sometimes on confusing positions.

Palo Alto

Palo Alto did a good job on the IPv6 interfaces and security policies. The GUI is quite intuitive and the policy accepts both protocols at the same time. Unluckily, there is no DHCPv6 server which makes it impossible to operate an IPv6-only client network behind a Palo Alto (without further servers).

Conclusion

It’s interesting to see the differences between those firewalls. While the Fortinet und Juniper firewalls support the whole SLAAC process incl. DNS servers, they have no single security policy for both protocols and are horrable to configure.

The Palo Alto is quite good to configure but lacks the DHCPv6 server. Same for the Cisco.

In summary, all firewalls position in the middle of my scale. From an IPv6-only view, I cannot say which one is the best. It depends….

Originally published on blog.webernetz.net

Disclosure: I am a real user, and this review is based on my own experience and opinions.

Buyer's Guide

Fortinet FortiGate

November 2024

Free Report: Fortinet FortiGate Reviews and More

Learn what your peers think about Fortinet FortiGate. Get advice and tips from experienced pros sharing their opinions. Updated: November 2024.

DOWNLOAD NOW

816,406 professionals have used our research since 2012.

it_user69816

Network Manager at a educational organization with 1,001-5,000 employees

Dec 1, 2013

Fortigate is Hard to Beat for the Money

Fortinet has been a darling of the stock market ever since its IPO in 2009 as its stock price has accelerated over recent years. Its stock performance has mirrored the adoration that its line of security devices consistently receive. Fortinet is the current UTM market leader, boasting a 20% market share. Fortinet is now expanding out of its core SMB strength and into the large enterprise market where the increasing performance of its solutions are making it attractively priced.

In Gartner’s latest Unified Threat Management Magic Quadrant (UTM) Fortinet is listed at the top of the leader quadrant. Says Gartner, “We believe attributes that contributed to the leadership position include Fortinet’s high awareness in the industry, in Gartner client’s short-lists and in competitive situations; Fortinet’s aggressive price/performance.”

A UTM or Unified Threat Management device is a firewall that includes other features as well. The Fortinet UTM package includes gateway firewall, anti-virus, web filter, intrusion protection, application control, VPN, email filtering and WAN optimization. Think of it as the “Everything Box.”

There line of UTM security appliances is called the Fortigate series. It offers an appliance to meet every type of network, from the home office to large enterprise networks, as well as Managed Security Service providers. Its smallest unit, the Fortigate-20C, also serves as a wireless router and offers four internal switch port in addition to a WAN port. At the top of the food chain is its new 5000 Series chassis based network appliance. It supports two, six, or fourteen FortiGate-5000 series network security blades, and allow you to scale security and customize your unique environment. These large units are ideal for virtual infrastructures as they can control up to 3,000 virtual domains.

The admin console for the Fortigate is browser based. Sometimes, browser based can have a cheesy rudimentary look but not with the Fortigate. Navigating the Fortigate is simple with its expandable menu. The admin console opens up to a Dashboard which displays a series of widgets that the administrator can populate according to their needs. It also comes with a command line interface which can be accessed through the admin console itself or through Putty.

Like all UTM appliances, the Fortigate units do some things better than others. Its web filtering is certainly more than suitable for most environments but if you are looking for super high granularity with a complicated array of user based filtering and exceptions, you probably would be better suited with a dedicated filtering appliance. The same probably holds true for its email filtering as well.

With this in mind though, what IT professionals are looking for first and foremost in a UTM device is security, and this is what Fortinet does best. Configuring the firewall of the Fortigate is a breeze. Simply create your firewall objects, consolidate them into groups if possible, and then create your policy rules. You can right click on any of your policies to view a separate context menu that will allow you to do things such as delete, move or edit the policies.

Integrating the other core components with your firewall policies is a snap. Simply apply the various UTM services you desire to the designated policies. For example, you would enable email filtering only to the rule configured for email traffic. You would then configure web filtering for the rule regarding your HTTP and HTTPS traffic while you would apply anti-virus to both rules.

Backing up and restoring your Fortigate configurations is as simple as clicking a single link and can be completed in less than a minute. Fortinet is continually releasing new builds and updates for all of its models. Simply download these firmware upgrades to any local device and click the update link and browse to the downloaded updates. You can revert back to an older firmware release at any time. Some of the more robust Fortigate models can be clustered into active-active or active-passive configuration.

Fortinet recently released version 5 which among other things includes Mobility Management. This feature does not include an additional license and is ideal for those organizations who allow BYOD devices.

If you browse some of the UTM discussion boards out there, you will find the phrase, “can’t beat it for the price” when discussing the Fortigate. The combination of its strong UTM features with a very affordable price point should certainly put Fortinet on the short list for any organization shopping for a new UTM appliance.

Disclosure: I am a real user, and this review is based on my own experience and opinions.

it_user3483Senior Consultant at Unify Square

Report as inappropriate

Jan 9, 2014

Great review Brad.
Only for the part related to upgrades from one version to another, I think you are a bit too optimistic :-)

Sometimes the update (and rollback) are not devoid of hassles (including parts of the configuration that not always work "as they are" in the new firmware).

Issam-Kawash

Sales project manager at Saraha

Mar 30, 2022

Download

Simple implementation, reliable, but security could improve

Pros and Cons

"All of the features of Fortinet FortiGate are useful and the security protection is good."

"The security of Fortinet FortiGate could improve."