What is our primary use case?
There are various use cases for Fortinet FortiGate, including firewall protection for internet access, data centers, branches, and SD-WAN. We use the firewall in multiple locations throughout our network, taking advantage of its many features, such as the promising CDR feature and security profiles like the WAF filter and application DNS security. We deploy these features in different parts of the network. Additionally, some customers use Fortinet FortiGate in the cloud to safeguard their cloud servers within platforms like Microsoft tenants.
Our customers are using Secure SD-WAN for connecting different branches. For example, oil and gas companies have different branches all over Egypt, which are not in the main city, so they need a secure connection and stability for certain protocols, such as voice and things like that. They also need visibility. They need to understand which applications are consuming SD-WAN.
Some of the customers are also using SD-WAN for load balancing. For SD-WAN, you need at least two internet connections, so some of the customers are using it as a load-balancing technique. Overall, there are a lot of features for which customers are using SD-WAN.
How has it helped my organization?
For our customers, Secure SD-WAN is very useful for giving the right priority to the applications and controlling the proper use of the application.
Secure SD-WAN's interoperability with other systems and applications in the environment is very good. The integrated application protection provided by Secure SD-WAN is also good. There is a very good integration with all the applications and portfolios. We don't integrate the firewall with the application itself, but it does what is needed to control and reroute the traffic.
Secure SD-WAN has a lot of benefits. There is a calculator on Fortinet's website. When you feed the right information to that calculator, it tells you how much money you will save by acquiring SD-WAN. The first benefit is that you're going to save money. Instead of buying multiple ISP connections, MPLS, and other such things, you can use the normal internet and apply SD-WAN on it, so you can save a lot of money. You also don't need to increase the bandwidth. SD-WAN helps with the routing of your traffic and the optimum use of your links. It's efficient and secure, and it saves you a lot of money, and of course, there is the security of the firewall that's applied on SD-WAN. If we're comparing it with other vendors like Cisco, you are not getting the firewall features.
It's very efficient. There is a lot of visibility. It reduces the number of incidents. If there is any problem, you can immediately log in to the firewall, and you will know if there is a notification about bandwidth consumption or any other issue, or if there is any drop in connectivity. It makes the operation very easy. It makes it easy for the teams to respond to incidents and manage issues. SD-WAN helps to remediate threats more quickly and efficiently because, with SD-WAN, there are a lot of applications going through different links, so if you can know which link an application is using and what's on the link, you can make the right decision in a very fast way to fix it. It provides both visibility and efficiency.
It reduces your mean time to detect (MTTD). In the new version, which is version 7.x, of the FortiGate firewall, through the main dashboard, you can know what is going on. If you've done the dashboard and you're putting these statistics in front of you on a screen, once you look at it, you'll know what's going on and what's the problem. It, of course, will give you the tools and the right information to reduce the time to solve.
It's hard to say whether it has reduced help desk tickets because it's more on the operational side, but it helps them a lot. The operations team is not handling the firewall. It's either the network team or the network security team. Generally, once it's up and running, it just works. It's different from having an antivirus or something else that can be changed from day-to-day activities. With this one, once you turn it on, the service will be stable unless you have a problem with your internet. It doesn't cause a lot of problems.
In terms of helping to future-proof business, from a partner perspective, it gives you a lot of flexibility to enhance the customer network. It opens a lot of doors for sales, for a new business, and for new potential. That's from the partner side. From the customer side, you can save money and solve a lot of problems. If you need to connect with a few branches all over the country, it's efficient. You don't need to travel for five to ten hours to reach the second branch. If you have proper SD-WAN technology and it's connected in a good way with good vendors, you can save a lot of time, effort, and money. You can have proper connectivity between branches as if the guy you are talking to is next door. So, SD-WAN gives a lot of benefits at the vendor level, partner level, and customer level.
What is most valuable?
Fortinet FortiGate is user-friendly and affordable.
When it comes to Secure SD-WAN, ease of use is valuable. The visibility and reporting are also valuable. A cool thing is that SD-WAN is free of charge with the Fortinet firewall. You can just use it just by using the Fortinet appliances that you already have in the branches. You cannot have appliances from different vendors. Fortinet customers can use the feature in a very easy way. It takes one click to integrate with the firewalls. It's very very easy to deploy. You don't need to build anything.
What needs improvement?
In the past, NSS Labs was utilized to test files and verify the numbers and datasheets. It would be beneficial to have an organization or testing lab that can verify the numbers in our datasheets since changes are frequently made, which can be inconvenient for review. For instance, when comparing different competitors such as Forcepoint, Palo Alto, and Check Point, the throughput or numbers in the datasheet may be lower than the actual numbers. Conversely, Fortinet typically reports very high numbers, but they cannot be replicated in the real world. Therefore, it would be advantageous for them to partner with a neutral testing organization such as NSS Labs to validate these numbers, thus providing more credibility and comfort to everyone regarding the accuracy of the datasheets.
For the migration, everyone has a firewall in use and I am selling Fortinet. Typically, I am replacing another firewall. Previously, there was a tool available to convert configurations from one firewall, such as Palo Alto, to Fortinet, but this tool is no longer free. If it could be made free again, it would be very beneficial. This tool shows a lot of promise and is very good. Making it free would help many companies deliver their products in a more efficient and integrated way. It would also be more valuable to include the tool with the firewall package or license instead of having to pay extra for it. Paying extra puts more pressure on small companies to deliver the firewall and complete the configuration, especially if they have hundreds or thousands of policies. It's very painful to move through these policies line by line.
The stability has room for improvement.
When it comes to Secure SD-WAN, everything is fine. They are going the right way. SD-WAN is very promising. They can provide the SD-WAN solution separately, but they will not take this approach because even the smallest firewall can support the features, so there is no need to have a separate service or appliance. They are following the right steps, and there is nothing to be improved. Feature-wise, I'm really satisfied with the new release, and the features they have added. For now, it's fine.
Learn what your peers think about Fortinet FortiGate. Get advice and tips from experienced pros sharing their opinions. Updated: May 2023.
706,951 professionals have used our research since 2012.
For how long have I used the solution?
I have been using Fortinet FortiGate for seven years, and I have been using Secure SD-WAN for two years.
What do I think about the stability of the solution?
Secure SD-WAN is stable, but when it comes to the firewall, sometimes there are issues with the throughput and related factors. Improper handling of these can lead to a memory surge, a well-known bug that can cause the entire system to freeze. When this happens, the system appears to be running but no traffic is processed, causing disruptions to applications, users, and overall internet connectivity. This can be confusing because the firewall appears to be functioning correctly. Typically, the solution is to restart the firewall. However, when we contact support, they require logs before restarting, which can be challenging in urgent situations. As a result, we prioritize quick resolution over troubleshooting. This is a common drawback of the operating system.
What do I think about the scalability of the solution?
I'd rate Fortinet FortiGate's scalability an eight out of ten.
How are customer service and support?
While the technical support offered online and on-site is generally effective, there may be occasions when we need to escalate an issue to a higher level due to its complexity.
I initially sought assistance from level-one support, but they were unable to resolve my issue. Eventually, they informed me that the problem would be addressed in a future patch. However, within a day or two, a level three engineer intervened and provided me with an update to resolve the issue. He explained that it required a command line configuration, as it couldn't be done through the graphical user interface. I was impressed with the level-three engineer's expertise and problem-solving skills. It taught me that if we persist and communicate our needs, we can achieve our desired outcomes.
How would you rate customer service and support?
How was the initial setup?
The initial setup is straightforward. We need to determine whether the firewall will be positioned in an active-standby or active-active configuration. Based on this decision, we will choose the appropriate license. If the firewall is intended for use with the Internet, we will need to include features such as a full DNS filter. However, if it's being used in a data center, these features may not be necessary. Additionally, we need to consider the speed of the interface, 1G or 10G, and the expected amount of network traffic to properly size the firewall model and ensure proper throughput. This is the initial phase of the process. Once the firewall has been deployed, it's a matter of connecting it and configuring policies.
When it comes to the deployment model of SD-WAN, my customers usually buy the appliance. They already have FortiGates, so we're just connecting firewalls to each other. In Kuwait and Egypt, there are mostly on-prem deployments. It's rare to have someone deploying a firewall on the cloud, and if it's deployed on the cloud, it's for a certain reason. It's not for SD-WAN because you're not loading balancing or you don't need SD-WAN for cloud access. In the countries where I was responsible for its implementation, there was only on-prem deployment.
There is one single challenge with the deployment of SD-WAN, but it's not from the FortiGate side. It's from the customer side. You need to understand your traffic so you can get the best out of SD-WAN. For some organizations, it's huge because they don't know which application is doing what and which is more important than the other. Especially during the COVID years, a lot of applications popped up. Companies used to release an application every few weeks. To do a proper implementation, you need to understand your network, understand your application, and set your priorities. Once you do this, the implementation will be a piece of cake. If you have all the information, it will take a day or two days.
What about the implementation team?
We implement the solution for our clients. One person can easily deploy multiple Fortinet products through the firewall including FortiAnalyzer for the logs, FortiManager, and FortiMail.
For SD-WAN also, one senior security engineer can do everything for a customer. The maintenance is easy. We haven't faced any critical problems with it.
What was our ROI?
We have experienced a positive return on investment by utilizing Fortinet's products. For instance, their website features a calculator for SDR, which enables us to measure the actual ROI in dollar amounts. We input our current expenses, the products we intend to purchase, and our connectivity plans, along with a few other details. At the end of the process, we receive data that indicates the amount of money we will save, such as two hundred thousand, for example. This provides us with clear and precise figures on our savings, making it an excellent tool.
Our customers have seen time to value with Secure SD-WAN. Its time to value is seen within weeks of implementation.
What's my experience with pricing, setup cost, and licensing?
The price for the Fortinet FortiGate is reasonable. Secure SD-WAN is free of charge. If you have their firewall, it's free of charge. It's very tempting. Other vendors, such as Palo Alto, will charge you to have an SD-WAN license, whereas, with Fortinet, it's free of charge.
What other advice do I have?
When purchasing a firewall, stability is non-negotiable. For small to medium businesses, Fortinet's affordability and ease of deployment make it a suitable option. However, for enterprise-level businesses, Palo Alto or Check Point would be preferred for their robust clients and immediate updates, despite the higher cost.
When comparing the pros and cons of Secure SD-WAN with other solutions, the challenge is not with SD-WAN. It's with the appliance that's offering SD-WAN, which is the firewall. So, the first comparison would be between the FortiGate firewall and other firewalls, and if the other firewalls are already offering the same service, the comparison will be between different levels, not just SD-WAN. There could be other firewalls that are more efficient or lower in cost or even more familiar to customers than Fortinet. So, the challenge is not with SD-WAN. The main reason I use SD-WAN on FortiGate is to get the benefit of the security profiles or security features of the firewall on top of the SD-WAN. Otherwise, I can use my internet router, the basic load balancing protocols, and the basic IP tunneling, and send some traffic here and some traffic there, and I'll save the cost.
I'd rate Fortinet FortiGate an eight out of ten.
Which deployment model are you using for this solution?
Disclosure: My company has a business relationship with this vendor other than being a customer: Integrator