It would be ideal if the solution offered SD-WAN capabilities. It's not as good as what is offered by Fortinet, for example.

They need to increase the number of ports in the firewall. Both Fortinet and Sophos, for example, provide many more than what Sangfor provides. 

I believe that IAM and NGFW need to merge into a single box, instead of there being two separate box solutions.

For some reason, Sangfor doesn't filter certain websites and applications. It should recognize them and utilize the bandwidth between applications. Also, if we try to block YouTube or Facebook videos, some users will use applications like Syphon for viewing so our bandwidth is still being utilized for non-work purposes. It might detect that somebody is using Syphon, but it cannot be blocked. It's not consistent, sometimes one user can be blocked while another will have access. 

Sangfor could improve their interface capacity on the 5100 series model and upgrade their hardware from one gig to 10 gig. This would improve the overall throughput. 

The web interface needs to be improved, making it more user-friendly.

The solution has too many bugs and these slow down the implementation. The software should be updated to account for this. 

An area for improvement would be the number of ports defined on the box. In the next release, I would like them to develop their provisioning stage of enrolling end devices.