Fortinet FortiOS Reviews

We primarily use the solution as a firewall operating system.

The built-in SD-WAN is the most valuable aspect of the product.

It is simple to set up. 

The solution has been stable so far. 

It's easy to scale. 

The pricing is excellent. 

SD-WAN configuration could be easier. 

The support could be better.

We'd like to see bandwidth optimization and traffic prioritization capabilities. These are the two things that I'm looking for, especially in SD-WAN.

I've been using the solution for three years. 

It's stable as a product. However, SD-WAN has some issues. The route policies and how you prioritize traffic are the areas of concern for us.

I'd rate the solution seven out of ten in terms of how stable it is. 

The scalability is great. 

We have 1,500 users using the solution. 

We are not very pleased with the support. It could be better. 

We are using Fortinet, however, we are exploring Palo Alto.

While the initial setup is not an issue, the SD-WAN configuration is a little complex.

There are three people here who are maintaining the firewalls.

The solution is the cheapest on the market. I'd rate it five out of five in terms of affordability.

I've compared this solution to other vendors. Palo Alto is number one in the world. Then I would go with Check Point. Then my third preference would be Fortinet.

We are end-users.

I'd rate the solution five out of ten. 

We use the solution as a perimeter firewall. 

It's simple to use in terms of inbound and outbound traffic management, traffic shaping, and connectivities, as well as the VPN. Everything is built into it, so it gives us quite a good well-rounded solution.

With assistance, the initial setup is easy.

The solution is stable and reliable. 

I would like to see more statistics in the monitoring part. There is monitoring, there are DSCPs, and everything; however, I would like to have more active monitoring of the traffic.

Sometimes we would like to monitor some threats. For example, where are some bots, and how do we detect these kinds of things. That would be good for us.

I've been using the solution for more than five years. 

We've been happy with the stability. It's been good so far. There are no bugs or glitches. It doesn't crash.

We are not scaling it right now. We bought it sometime back and we didn't need to scale it. We bought a higher end for our use case, which is still sufficient for another few years.

We have 200 or so users of different levels and positions on it.

We do not have plans to increase usage. 

This firewall is quite a capable firewall - even up to 1000 users. Due to that, we didn't find any requirement to expand it or replace it somehow. It has helped us build our software-defined WAN, LAN, et cetera. It is sufficient for us. It gives us Gbps throughput, which is good enough. The firewall itself is 32Gbps capable, which is more than what we need.

We have used support sometimes. That said, mostly we use it via the third party directly. They are helping us with support of any type that we need.

There was something else that was used. However, I don't remember what was that previously.

The initial setup was easy for us as we had assistance. 

For the deployment, one person was involved from the outside, and two people we assisting from our side. In total, three people were involved.

The deployment itself took a few days as we were rebuilding policies as well.

The initial setup was done by the contractor. For that reason, we had no problem implementing this.

The ROI we have witnessed is good. I would rate it five out of five. 

We started with a three-year license and have since renewed it. 

For three years, we paid about 2,800 KD, which is about $9,000.

The product is pretty affordable overall.

We are just customers of the solution. 

We're not using the most recent version. We updated it a few years ago and we are still using that version.

I'd rate the solution ten out of ten. We are really happy with it in general. 

Potential users should plan what they want to do with it before buying something this big and this good. They should know what they want to do first and then act accordingly.

FortiOS is just an operating system. That's it. It's a firmware FortiGate is running. 

FortiOS is the foundation of the Fortinet secured fabric.

You can have virtual domains. On top of each virtual domain, you can see the independent system. When comparing Fortinet with other vendors, the good part is you can set different priorities. It depends on different VDOMs. In my case, I have two VDOMs. One is called a VPN VDOM; the other is called a web filter VDOM. Usually, for other vendors, no matter how many domains, just one primary device is always a primary one. However, for FortiGate, you can separate them. In my case, I have machine one, and machine two. FortiGate one, Fortigate two. And for each FortiGate, we can have multiple VDOMs. In my case, I have two VDOMs. If you want to save money, you can split the workload, and this capability helps us save on costs.

It's very flexible firmware. 

I really like it overall. It really meets lots of my requirements.

The initial setup is easy.

It's easy to use. 

The solution is quite stable.

Right now, all the features meet my requirements. It's not lacking in any way.

I have more than ten years of experience with the solution. 

The stability is good. There are no bugs or glitches. It doesn't crash or freeze. It is reliable. In terms of hardware. We are in a cycle right now to handle hardware replacement. We've been using the hardware for seven years now. 

I have more than 400 stores nationally in Canada. I have it in every  different location. For each store, for business continuity purposes, we have two internet connections. One is the primary internet connection; the secondary is the LTE. 

LTE is expensive, so we always use the primary, like cable or PPPoE. Unless the cable or PPPoE fails, then we switch traffic to LTE. Even for LTE, we control the traffic. For example, we have backup traffic. For LTE, we don't allow the backup traffic to go through LTE since LTE is for business continuity purposes only.

For redundancy, you build up the HA environment, meaning, at a minimum, you have two devices to work together. The secondary is always just sleeping there, dormant. When the primary fails, then you switch over to secondary.

However, for Fortinet, on top of this, you can have multiple VDOMs.

I'm a very senior tech guy, and therefore I would rarely need their services. However, I will say they have been much better, and we find them helpful. 

I've had previous experience with Cisco products.

The initial setup is very good. I'm a Cisco guy; I'm used to the command line interface. Therefore, right now, from my command line point of view, I like it. The hierarchy of the command line is very clear and it's very easy to change as needed.

The license is based on the machine itself, not on how many users. That's why we backhaul all the internet traffic to my head office, so in my head office, I only need to buy one license. To access the internet, we have a VPN tunnel. 

I'm not sure of the exact costs. I didn't purchase it, I just use it. 

I've compared the solution to Palo Alto and Cisco. 

Right now, more and more services are moving to the cloud. In terms of the cloud, the IP address changes so frequently. Today you see this IP for this service, the next day, without notifications, they may change IP to other IP addresses. So, originally, all firewall rules were based on the IP address. Now, it's not based on the IP address; it's based on the service. I can see Fortinet has already worked on this. For example, they provide internet service, which I remember, even though I haven't tried it yet. There's an internet service called Office 365. You just use this; you don't need to know the exact IP address or something; you just use this name. In the background, Fortinet updates this, updates all the information about this group, so you don't need to. The firewall keeps retrieving all that information from Fortinet, so you don't have to worry about the frequent change on the cloud side.

So far, I'm very satisfied with this device. Compared with other vendors, like Palo Alto and Cisco, I'm delighted with FortiGate, to be honest.

I'd rate it ten out of ten.

FortiOS is the operating system of the FortiGate firewall. So whether it's an actual device or virtual machine, FortiOS is the actual software running.

FortiOS is dedicated to the next-generation firewalls. You can't really use it for anything else.

Essentially, their IPS and DNS filtering databases are the most useful for us. The industrial protocol database, which is the main one that we use, is great. They do extensive research to make sure that all the CVEs that they include in the IPS database are up to date and they keep it up to date. And that they don't miss any threats.

Their classification inside of that database of the various threats is typically very, very good. It's, for that matter, one of the best we've seen.

The IPS, IDS database with the DNS and industrial database are the three core main features that are the best for us.

We don't really find a lot of issues on it.

If I really have to complain about something, and there's not much, is the free VPN solution is a bit limited. Then again, it is a free solution. That's essentially it. Nothing else on the FortiGate or on the Fortinet OS side is really an issue. That's one of the main reasons why we use them: everything works and works well.

For what we use, there isn't really any missing feature. In fact, we actually want to get rid of some of the features that they have due to the fact that, for the security model that we need to implement, having more features actually opens up potential risk. We actually would like to have a device that is more focused specifically on OT environments the operational technologies.

We would prefer a device that's stripped down, that doesn't have all the other fluff in the more enterprise system. We actually want a feature where we can remove features that are there that we don't use. That is actually a thing that we find. We use it now in an operational technology environment. We use normal IT equipment. However, it's not a normal IT network. It differs significantly from a normal corporate IT environment. In a normal corporate IT environment, you like the fluff, and the additional features, and you can click, click, click, and you're done.

However, all of those features you add to a device open up risk for us. And that is something we do differently in the OT environment in operational technology. We prefer to not have the fluff. We prefer to have only what is needed for the device to do what it needs to do.

For example, imagine an additional feature for some sort of additional VPN technology has been added. However, it's not really needed for the OT environment, and it's not configured on the device, yet there's some sort of security threat in there. Now, all of a sudden, somebody can hack your system, and he's in there, and he's switching the lights on and off the entire city. And you don't know about it due to the fact that the additional fluff that we added to the system, we weren't aware of that issue was on there.

You can enable and disable certain modules in it. However, with disabling, nobody can really tell us if that module is disabled. Is it really disabled? Is it actually unloaded? Is it uninstalling Word from your laptop, or is it just not running Word?

I've been using the solution since 2009, give or take. That's almost 13 years.

We don't have any instability issues.

The solution can scale reasonably well, within the means, of course, of the device itself. You buy the device based on the current network requirements. We typically build in a bit of extra expandability into there to ensure that the device can cope with the additional load on it.

It greatly depends on the unit itself and what the limitations are. However, typically, expanding past that limit it's not complicated. Still, you'll have to procure a new unit. It's very crucial for us at the beginning phase to make sure that we know exactly what the customer's networking requirements are in terms of bandwidth, IPS, IDS, and throughput.

If a VPN needs to come in, we’ll need to consider what is done with the requirements of the VPN. And then, based on that, we'll specify the unit with additional capacity. However, if you go outside of the unit's capacity, you'll have to get a new or bigger unit.

It's actually an OT environment, not an IT environment. The actual user base is relatively small as not many people are allowed to use the operational side of things.

It's not like a normal enterprise network where you have thousands of people connected to it. It's very small. And when I say very small, it's typically ten or maybe 20 users.

If you log a support call, they have support engineers that jump on that support call very quickly to try and sort out your issue. There are absolutely no complaints that we have on their support side.

Positive

If you are a novice person that has never worked with any firewall and don't really understand the concepts, you may find it challenging to set up. However, there are help files, online tutorials, and videos that guide you on any of the topics you have in it.

It really helps you a lot to get to it in order to do the configuration. So it varies. It depends on how you install it. It may be fairly easy for your average user at home or for an average enterprise guy. However, for a process environment, it may be a bit more challenging since there are different approaches that we follow in order to install it. That said, Fortinet itself is not very difficult to use and its knowledge base and help are very extensive.

We only need one person to deploy the solution.

How long deployment takes depends on the customer requirements and what they require for their network that we need to implement. For the actual deployment of the FortiOS and the initial testing, you're looking anything from a day to about four days' worth of work.

That said, your pre-prep, in other words, all your pre-definition of your firewall rules and what security model you need to run and what security level in your Purdue model that you need to implement, can take a good couple of months to do since it's purely based on how you apply the IEC 62442.

It also greatly depends on what the customer needs are. The pre-prep work is actually the most important. The actual configuration is quick. However, the pre-prep work takes quite a while.

It's probably one of the best devices you have for ROI, especially regarding the current security landscape that we are in with the current kinds of security threats and stuff flying around. FortiGate is one of the best solutions regarding your return on investment.

If you look at the way that you'll typically have to try and clean systems, let's say, if you were infected with very bad ransomware, the amount of cost and effort and money that you'll have to spend in order to clean all your systems and get all your IT equipment and everything running in top form condition.

If you don't have a FortiGate unit protecting you, and you compare that to installing a proper FortiGate unit with all the correct modules and stuff like that, your ROI on it is much better than trying to clean everything after an attack. It's definitely well worth your investment.

There are different types of licensing. It depends on what kind of licensing you decide to take, if it's on an annual basis or if it's a three-year basis. It also depends on what modules you have selected in your firewall.

If you have the next business day on-site warranty, and if you have the actual hardware replacement, the normal RMA on devices like Cisco and those devices where the device fails, the company comes out and swaps the device out for you free of charge, that comes at a price.

It greatly depends on what options you take with their warranties and guarantees and stuff. It's very difficult to say what the licensing is until you break down which module you will take.

You need to buy the modules or the add-ons based on your needs. Licensing then will be directly connected to that. It’s like purchasing Windows. You can just buy Windows. However, you won't get Office working necessarily. It's the same with the FortiOS licensing. You buy the OS; then you buy everything you want to run on it.

You can just buy the operating system, the FortiOS. However, it won't give you IPS or any other advanced firewall rules. That will be an additional cost on your licensing.

They are slightly on the pricey side. They are affordable. However, they are not cheap. I’d rate them a two out of five in terms of affordability.

All of the infrastructure is hosted locally on-prem. We can't host it in the cloud due to security reasons.

We’re resellers more than partners. We provide the solution to customers. It's an industrial process environment.

Whether we use the latest deployment or not depends on the customer. However, we prefer to not install the latest version. We typically install two or three versions backward. The reason is, that your latest versions typically have a lot of bugs that are not necessarily known yet. Since this is a process plant, which is not directly connected to the internet, effectively, you go through a Purdue model, which connects to layer three or layer four before they get to the corporate network.

That then will break them out to the internet. The risk model for that is okay to have them not on the latest version. Also, since it is a process environment, literally, it's a process plant; it's an industrial process plant. The performance and uptime is king, not so much anything else. In a normal corporate environment, uptime and security is king. However, in a process environment, you need to keep the plant running 24/7 in order to pay the bills. The way that you look at how you install the product is quite a bit different than normal enterprise IT.

I’d rate the solution ten out of ten.

It is the best solution for users if they start out in a secure environment. They just need to make sure that they partner up with the correct partner that can guide them through the processes of obtaining the correct device and obtaining the correct training for themselves in order to use the device. That said, it's a highly recommended device to use from a perspective of security, usability, and installability.

The solution is basically an OS for Fortinet.

Security and authentication are the most valuable aspects of the product. The classification of the websites is helpful.

The solution is stable and reliable.

We have several access points on FortiGate, which were procured long ago. Those are not supporting the present firmware update we make on the UTM. Therefore, we cannot get the latest firmware updated on the UTMs. I was thinking that if we need to get rid of these physical devices, we should move to some cloud-based system.

The only problem that we are facing at the moment is that all the devices of FortiGate, whether it is for FortiGate's access points or authenticator or controllers or UTM, is in the FortiOS. They are interrelated and interdependent. It means if I buy a FortiGate car, I have to run FortiGate OS, I have to fill in FortiGate fuel, and I have to run it on a Fortinet road. I can’t mix and match it with different solutions. There is no flexibility.

The initial setup is a bit complex.

We would like to have NMS built into the solution.

We’ve been using the solution for the last ten years.

The solution is stable. We’ve never had any issues with the product. It’s reliable. There are no bugs or glitches.

If I need to scale it up, then again, I have to change the entire family of it.

The amount of users connected at any given point is something around 6,000, including the students and the people on move.

We never use tech support from Fortinet. We get support from a local supplier.

We are tied to Fortinet and therefore did not use any other product.

Initially, the solution can be a bit complex to set up. It’s not simple. There’s a learning curve. You need to train on it a bit first.

We have ten to 12 people on hand who are specialized in FortiOS and can handle deployment and maintenance tasks. We have a total of 20 people working on maintenance.

The pricing is pretty high. I’d rate it at a two or three out of five in terms of affordability.

Since the pandemic, a lot of things have gotten exponentially higher. Also, for us, the final price is dependent on the dollar conversion rate. You can get a license for one or up to five years.

Since we are tied to Fortinet and could not use anything else, we did not compare it to other solutions.

We are customers and end-users.

I’d rate the solution seven out of ten.

I’d recommend the solution for an enterprise user. However, it may be a bit much for a small or medium-sized organization.

I use Fortinet FortiOS for firewalls.

The most valuable features of Fortinet FortiOS are user-friendliness, ease of use, and threat prevention.

I have been using Fortinet FortiOS for approximately two years.

Fortinet FortiOS is stable.

We have approximately 100 users using Fortinet FortiOS. All levels of employees are using the solution.

The support from Fortinet FortiOS has been good. They had the knowledge and professionalism.

We were using Juniper before we choose Fortinet FortiOS.

The initial setup of Fortinet FortiOS was very easy. The configuration was simple to do. The whole implementation took approximately two weeks.

We had assistance from one person from our local vendor for the implementation.

Fortinet FortiOS is very effective and easy to use to configure. I would recommend it to others.

I rate Fortinet FortiOS a ten out of ten.

We use Fortinet to secure the environment at our data center and LAN.

I would like to see the features of FortiAnalyzer included in Fortinet FortiOS. Right now, you're required to have an additional license and a different device for features such as processing the log, reporting, and analyzing traffic.

I have been using this solution for about six or seven years.

The stability of Fortinet meets our requirements and I'm satisfied with it.

The solution was easy to set up. 

I deployed the solution by myself and it took about one to two months.

I would rate this solution as a seven out of ten.

The most valuable features of Fortinet FortiOS are its simplicity, highly user-centric, and performs well. The line speed and for heavy traffic, is helpful for us.

Fortinet FortiOS can improve by limiting the need for the CLI and GUI combination. The more functions they can have on the GUI and less on CLI would be helpful.

I have used Fortinet FortiOS within the last 12 months.

The stability of Fortinet FortiOS has been good, I have not had any issues at this point.

Fortinet FortiOS scalability has been good. However, we only have a small setup. 

The support offered by Fortinet FortiOS is good.

The initial setup of Fortinet FortiOS is straightforward.

The price of Fortinet FortiOS is less than $10,000 annually. The price of the support is reasonable compared to competitors.

I rate Fortinet FortiOS a seven out of ten.

We're using the solution for firewall segmentation, including segmentation of the network, authentication purposes, logins, et cetera.

Compared to other firewalls, segmentation is much easier in FortiGate.

The initial setup is straightforward. 

The support could be better. Their first-level support is often poorly trained. 

We don't have any other requirements in terms of needing new features. 

I've used the solution for ten years. 

The solution is stable. There are no bugs or glitches. It doesn't crash or freeze. 

It's scalable. The model we bought is highly scalable. However, if you buy a device on the low end, it may not be scalable. You need to consider what you need in advance and buy more than you need if you believe you will need to scale. 

Technical support is okay. Compared to Palo Alto, they need to improve a bit. Palo Alto is better. The first-level team isn't very knowledgeable. 

Neutral

I work with Palo Alto, Cisco, Fortinet, et cetera.

The initial setup is very simple and straightforward. It's not overly complex or difficult. You only need one person to implement the solution. 

The deployment will take only one hour, however, the policy web creation based on the user requirements may take time. That is the nature of every firewall. Usually, the deployment takes only one to two hours.

We handled the setup in-house. We didn't need any outside assistance. 

I don't directly deal with licensing. I can't speak to the exact costs.

I'm an end-user. I used to be a partner. 

We're using the latest version of the solution and update regularly.

I'd rate the solution seven out of ten. 

We are consultant architects so our role is to set up firewalls for our customers, who are usually small and medium-sized companies. 

I like that the firewall gives me a lot of control in terms of outgoing and inbound traffic, and it scores better in deep packet inspections when compared with the Azure Firewall.

The support could be improved, Fortinet's response time is very slow. 

Setting up the VPN could be made much easier, especially when deployed with Azure.

I have been using the solution for a year now.

The product is pretty stable.

The solution is scalable.

The initial setup of this solution is relatively easy.

The pricing could always be lower.

If I'm going with Azure data center, my first recommendation would always be Azure Firewall with the newly launched premium services. Otherwise, Fortinet is pretty good.

I rate this solution an eight out of ten. I advise users to go through the documentation very thoroughly as it's not the same as your on-premises Fortinet Power. It's slightly different. Setting up the VPN is a bit tricky in Azure, deploying the Fortinet firewall and Azure is somewhat tricky.