Fortinet FortiGate Reviews

We are using this solution to filter communication to and from the website or our site. 

We also use it to create a VPN connection for all of our sites in the world.

I like that they have given me a solution at a fair price.

The user interface could be improved.

I have been working with FortiGate for more than ten years.

It's a stable solution, we have not had any issues. It works.

It's a scalable product. We have 600 users in our organization.

We have not contacted technical support. We have been fortunate in that we did not have any issues that needed it.

I am working as a manager, and I am not doing any of the configurations.

We only require one person for the maintenance of this solution.

The pricing is fair.

I would recommend this solution to others who are interested in using it. That said, nothing is perfect and there is always room for improvement.

I would rate Fortinet FortiGate an eight out of ten.

We use it for our paralegal security, our internet operations, and network zone segmentation.

It could be more stable and secure. They can improve the ability to make changes, change requests, and provide more rounded monitoring in terms of security and potential threats.

My team has been using Fortinet FortiGate for a few years.

Fortinet FortiGate appears to be stable. 

Fortinet FortiGate appears to be scalable. 

We previously used Palo Alto.

The setup is pretty complex and not easy to implement. 

Implemented by our in-house team. 

I would give Fortinet FortiGate a seven out of ten.

We use it to protect our or our customers' full environment by using features such as IPS signatures, VPN, endpoint protection, and antivirus.

The application control features, such as Facebook blocking and Spotify blocking, are the most valuable.

The license renewal process, annual renewal price, and the web application firewall features should be improved.

I have been using this solution for two years.

It has been very stable and reliable. We are comfortable with its stability.

It is good enough for us. We have about 15 employees who use this solution.

I would rate them a nine out of ten.

The set up was a little complex, but the interface and the process are user friendly.

The license is too expensive to renew. The license renewal process is also complex. 

I would advise others to use the documentation. The official documentation is very comprehensive and complete. I use the Cookbook Reference Guide.

I would rate Fortinet FortiGate an eight out of ten. 

This firewall is an antivirus, protects against spam, and is an IPS.

The most valuable feature is the web filter.

The performance is fine.

Some of the features in the graphical user interface do not work, which requires that we used the command-line-interface. We have problems with that.

Log retention should be greater than 24 hours.

I have been using FortiGate for about eight years.

The complexity of the initial setup depends on the implementation. There are some that are very simple, whereas others are complex.

I would rate this solution a ten out of ten.

We used FG-90D as UTM device to protect some users and servers, and also to enable inter-vlan routing with advanced security policies inside our lab zone. Also used FG-500D in transparent mode in front of Cisco ASA for advanced and high performance protection by applying IPS, AV, AntiSpam, App.Control and DoS-protection profiles.

We have better manageability: opening and closing ports/services, adding addresses is done very quickly (can be done in single page of the web GUI).

It offers outstanding reporting tools when coupled with FortiAnalyzer (Fortinet's log collector and reporting tool) help meet compliance (there are PCIDSS, HIPAA and many more report types).

Better security posture: safe web surfing, less spam and viruses in incoming email messages, very granular AppControl, blocking vulnerability exploitation attempts and traffic anomalies by IPS, preventing DoS attacks by DoS policies.

Good VPN, both IPSEC and SSL (web-mode, tunnel-mode). An engineer/network administrator has tools to debug VPN issues that can occur during tunnel setup with other vendors' equipment.

SD-WAN feature at no cost. This is really great feature for remote locations (branch offices) and HQ, application steering between many ISP links becomes a simple task. Steering can be done dynamically by measuring link quality (latency, jitter, packet loss, available bandwidth).

Wi-Fi and Switch controller at no cost. FortiSwitch and FortiAP can become a kind of port extender of the firewall, all its ports can be referenced in firewall policies. When you have such management plane consolidation it gives you a simpler way to operate.

Security Fabric Framework is helping in analyzing sudden and rapid changes in whole infrastructure, and gives the ability to simplify daily operations (e.g. address objects synchronization between all firewalls in Fabric, estimating overall security rating, single-sign-on for admin access and many more)

Single Sign On support with deep LDAP integration (several variants for environments with different scales), RADIUS authentication.

Can work as transparent and explicit web-proxy, the last option supports Kerberos authentication which requires no agents installed on any windows server.

Human readable firewall policies with editable security policies and
addresses in single page. This is very useful and time saving feature.

Firmware upgrade process is very simple, even for cluster configurations it is fully automated by default.

Straightforward SNAT and DNAT; you may work in two ways: with Central NAT rules configuration and by applying translation directly inside firewall policies.

Bulk CLI commands are uploaded via gui in script file (portions of config file).

VDOMs are very useful when you need to grant admin role to clients separately. VDOMs in FortiGate can be represented in FortiAnalyzer's ADOMs (administrative domain), which can have different log storage policies, event handling and alerting configurations. You can create one VDOM working in NAT/Route mode, and another VDOM working in Transparent mode.

If you don't want to create and use second VDOM you can still transparently inspect traffic at layer 2 level while having only one VDOM in NAT/Route mode. This is achived by configuring Virtual Wire Pair ports that work like a separate bridge.

Ability to capture packets going through any interface of device (and VM too). You can set number of packets, filter out packets by IP and port number for particular troubleshooting purposes, then download a .pcap file from web gui and analyze it in your favorite programm.

Advanced routing (RIP, OSPF, BGP, PBR). It gives you a seamless and simple integration into a large network.

IPS, AV, Web Filter, AppControl profiles are working very well.

SSL Inspection and CASI (Cloud Access Security Inspection) profiles.

Rich logging options allow you troubleshoot most problems.

Straightforward HA with different redundancy schemas.

IPv6 support.

I think there could be more QoS features in GUI. FortiGate has Traffic Shaping feature that is enough in most cases when shaping egressing packets, but sometimes I just need 802.1p prioritizing (Class of Service) of incoming packets and manual ingress queue assignment. This is what would be nice to have, but I realize that such a job is more efficiently done by L4 switch standing before firewall. Fortinet has a FortiSwitch that can do it, and it also can be controlled by FortiGate via FortiLink protocol.

[Firmware version FortiOS 6.2 update]: There are a lot of improved and newly added things, so it is very hard to imagine any additional features.

Four years.

Small models (up to FG-90) are build on SoC (System on a Chip), so they need to be mounted in places with enough airflow and right temperature, otherwise they could hang, slow down traffic processing, but more often you just can't log in to the device's web-interface (reboot won't help you until it cools down). Actually, that's not an issue. It is a technical requirement for operating environment to be 5-40 degrees (but at 35 degrees with poor airflow there may be issues mentioned above).

For large scale deployment I would suggest to look at FortiManager, a central management point for large amount of FortiGates. I have tested the solution and found it quite useful. I could download configuration from any device and install edited list of policies to several devices simultaneously through a couple of clicks. Also I liked functionality of clearing out Address objects list from unused entries. It can be configured to be a central repository of firmware and updates, and a local rating server (url and antispam rating services) which can improve rating lookup latency value.

Technical support is good (in average).

We used an old IPS from Cisco. We switched because of End-of-Support on that device.

Initial setup in plain networks is very straightforward. For large environment you should prepare beforehand, because FortiGate is a highly-tunable and feature rich product, so you must have a plan with many considered details.

We did not engage a vendor team. Documentation is good enough to implement with an in-house team.

Setup cost may be not so low, as you expect, because it depends on different factors, but TCO for 5 years may pleasantly surprise you.

Palo Alto, Cisco ASA, CheckPoint

Many interesting things are hidden in CLI, they can help you in different situations. Web-interface (GUI) is primarily intended for day-to-day routine.

Don't underestimate FortiAnalyzer. It can give you a better understanding of what is going on in your network. When FortiGate sends logs to FortiAnalyzer, FortiAnalyzer inserts received log data into database. Predefined and customizable data queries, charts and reports can significantly help you by visualizing problem points, so you can thoroughly investigate security events and traffic behavior anomalies.

FortiGate is a constantly evolving product, so pay attention to FortiOS version it runs.

We are dealing in the payment business where we provide services to end-users, and FortiGate is part of our security solution.

The customers swipe their cards into our product, which transmits the data through another server to the acquirer or bank. The server is hosted behind the FortiGate firewall, so all of the traffic that comes in and out goes through the firewall policies, intrusion detection, and instruction prevention systems.

We use the FortiGate Sandbox to detect zero-day vulnerabilities, such as anomalies or malware, that are unknown and have not yet been discovered.

We would like to see a better training platform implemented.

We have been using Fortinet FortiGate for the past five years.

This is a scalable solution. We are able to integrate new products and different payment options. As new projects come in, we are looking for a hybrid setup that will incorporate the cloud.

We have been in contact with technical support and I find them to be good. We've had no issues with them.

We are continuing to use FortiGate but we are in the process of upgrading to the 200E and 300E enterprise firewall.

The initial setup was complex. We had to connect it and set up the PCI DSS compliance. To maintain this, there are a lot of things that have to be done on a regular basis. This includes scanning and hardening the servers, then rescanning. Initially, it is very complex.

We have the FortiGate firewall in our environment, and we are using network segmentation. Based on the segmentation, there are policies. Based on the policies, the traffic to the critical components is monitored and goes through the IDS/IPS antivirus profile. We also have hosted applications, so a basic DDoS and WAP are configured.

I would rate this solution a nine out of ten.

I primarily use this solution for external security of our network.

We are a visual effects company, and there have been a number of high profile security issues in our industry. This has brought us to a higher standard of security, which our clients are very keen on these days. 

We had a minor problem where there was a major system upgrade on the hardware platform and the Apple Mac client was not available as soon as it might have been. The PC client was available immediately, but we had to wait a month or so, before there was a Apple Mac client. I was slightly irritated that it was not ready on time, but it was eventually resolved.

Almost two years.

Fortigate has more than adequate capability to cope with everything we require for the foreseeable future. 

The support is very good, and we have had no issues. 

Previously had a SonicWall. Even allowing for an upgrade discount on the SonicWall, the FortiGate was a more compelling purchase.

It was fairly straightforward. 

FortiGate is used as the primary firewall and malware detection device for the company.

This solution allows solid VPN service for access from the field, and the anti-virus/anti-malware detection works well.

SSL-VPN is very useful for us and has been very reliable.

The user interface could be improved to make it less confusing and easier to set up. There are too many pull-down menus.

I have been using FortiGate for five years.