FortiGate or WatchGuard: which firewall should an SMB choose?

You need to replace an end-of-life firewall, or the carrier router that has been standing in for one, and two names keep appearing in the quotes: Fortinet with FortiGate, WatchGuard with Firebox. The datasheets look alike, the sales teams on both sides claim to be the best, and you have no time to run a lab test. As a partner of both vendors, Fortinet and WatchGuard, we have the luxury of no religion: we install one or the other depending on the context. Here is how we choose, criterion by criterion, and the questions to ask yourself before signing.

The short answer

For an SMB, both firewalls protect equally well. The choice comes down to three questions: how many sites need connecting, who will run the box day to day, and which other security needs you already have or will soon have, such as multi-factor authentication or endpoint protection. A single site without a network team leans towards WatchGuard; a multi-site organisation or one with demanding network requirements leans towards FortiGate.

The comparison in one table

Criterion	FortiGate (Fortinet)	WatchGuard Firebox	Advantage
Protection (IPS, antivirus, web and DNS filtering, sandbox, SSL inspection)	Complete with the right bundle	Complete with Total Security Suite	Draw
Day-to-day administration	FortiOS, very granular, more technical	WatchGuard Cloud, readable, built for small teams	WatchGuard
Multi-factor authentication (MFA)	FortiToken, mostly around the firewall and VPN	AuthPoint, extended to Windows, Microsoft 365 and SaaS apps	WatchGuard
SD-WAN and multi-site	Built in, fine-grained, the market reference	Available, less depth	Fortinet
Network ecosystem	FortiSwitch, FortiAP, FortiClient managed from the firewall	Switches, WiFi and EDR, shorter catalogue	Fortinet
Range	From branch desktop units to data-centre chassis	From desktop Firebox T to rack-mount Firebox M	Fortinet for very large sites
Licensing	FortiCare, then UTP, ATP or Enterprise Protection bundles	Basic Security Suite or Total Security Suite	Draw, compare like for like

This table sums up our field experience. It does not replace an analysis of your network: a criterion marked “Fortinet” is irrelevant if you only have one site.

Security: a draw for an SMB

Both offer a complete next-generation firewall: application inspection, intrusion prevention, stream antivirus, web and DNS filtering, a sandbox to analyse suspicious files, and inspection of encrypted traffic. Both rely on research teams that push signature updates continuously, as long as the licence is active. The choice is not decided here.

What makes the difference is configuration. A FortiGate or Firebox with SSL inspection switched off, “allow all” rules and firmware never updated protects less than the cheaper of the two set up properly. We cover the essential settings in 10 security settings after installing a FortiGate, and the logic is the same on a Firebox.

Administration: WatchGuard is simpler

WatchGuard Cloud brings firewall, MFA, WiFi and endpoints together in a readable console, with configuration templates and ready-made reports. For an SMB without an in-house network administrator, the time saved is real: a generalist IT manager understands what they see and can check the state of protection without getting lost.

FortiOS is deeper and more granular. Everything can be tuned, from dynamic routing to per-application security profiles, but that richness demands more skill. For an IT team that wants full control, or a managed service provider running the box, it is an asset. For a managing director who just wants to glance at the reports, the interface is more intimidating.

MFA: advantage WatchGuard

AuthPoint is one of the most mature MFA products on the market. It covers the VPN, Windows logon, Microsoft 365 and many SaaS applications, with a simple mobile app for users. When an SMB has to roll out MFA across the board, often because an insurer or a major customer requires it, having the firewall and MFA in the same console makes the project simpler.

Fortinet offers FortiToken, effective for the VPN and firewall administration, less elegant for uses that do not go through the FortiGate. Many of our FortiGate clients use Microsoft 365’s own MFA for email anyway. Our MFA rollout guide explains how to go about it without locking teams out.

SD-WAN and multi-site: advantage Fortinet

To connect a head office and branches over several carrier links, FortiGate is the reference: SD-WAN built in at no extra licence cost, fine failover between fibre and 4G backup, prioritisation of voice and business applications, and site-to-site VPN tunnels managed centrally. We go into detail in our article on multi-site FortiGate SD-WAN. WatchGuard does SD-WAN, but with less depth in routing policies and link quality measurement.

Ecosystem: Fortinet is broader

FortiSwitch switches, FortiAP access points, the FortiClient agent: Fortinet covers the whole network from the firewall, which becomes the management console for switches and WiFi. WatchGuard also offers switches, WiFi access points and endpoint protection, with a smaller catalogue but consistent integration in WatchGuard Cloud. If you plan to renew switches and WiFi at the same time, the Fortinet ecosystem weighs more.

Licensing and three-year cost

Both work the same way: an appliance plus a security services subscription to renew. With Fortinet, FortiCare for support, then a UTP, ATP or Enterprise Protection bundle depending on the level of protection, as explained in FortiGate for SMBs: which model to choose. With WatchGuard, the Basic Security Suite or Total Security Suite, covered in our WatchGuard Firebox guide for SMBs.

At equivalent scope, price differences are small and shift with the promotions of the moment. What costs money is an undersized model: throughput with every protection switched on is only a fraction of the firewall throughput on the datasheet. We size on that inspected throughput, never on the sales sheet. So compare quotes over three years, hardware and licences included, and check that each quote states the throughput with inspection on.

Our method for choosing

1. Map the sites, internet links, remote workers and traffic between branches.
2. Decide who will administer the firewall: in-house team, provider, or nobody. It is often the deciding factor.
3. List the neighbouring needs: MFA, endpoint protection, WiFi, switches due for renewal.
4. Measure real traffic to size on inspected throughput, with headroom for growth.
5. Compare two quotes like for like, over three years, with the same licence level.
6. Plan operations: firmware updates, rule reviews, log reading, licence renewals.

The mistakes we see most

1. Choosing the brand before counting sites and users.
2. Comparing a quote with a full licence to a quote with support only.
3. Sizing on the datasheet firewall throughput, then turning inspection off “because it slows things down”.
4. Buying the most powerful firewall with nobody to run it: a feature-rich box badly configured protects badly.
5. Letting the licence expire unnoticed: the box keeps routing but no longer receives signatures.
6. Forgetting MFA on the VPN, attackers’ favourite way in.

Checklist before signing

• Number of sites, internet links and remote workers known.
• Person or provider responsible for administration identified.
• Inspected throughput of each proposed model compared with the sum of your links.
• Same licence level in the quotes being compared, over three years.
• MFA planned for the VPN and firewall administration.
• Needs for switches, WiFi and endpoint protection assessed.
• Licence renewal date recorded and tracked.
• Migration plan for existing rules, with a rollback option.

Our recommendation in one sentence

A single-site SMB without a network team: WatchGuard. A multi-site, industrial or network-demanding organisation: FortiGate. In both cases, a firewall is only as good as its operation: rules reviewed, firmware current, logs read.

How we work

We start with a free initial audit: inventory of sites, traffic measurement, review of the current configuration. We then recommend the vendor and model that fit, with a three-year hardware and licence quote. Deployment covers rule migration, segmentation, VPN with MFA and, where relevant, SD-WAN. Once live, the firewall is covered by our 24/7 monitoring, and a critical incident is picked up in under 15 minutes. All of this is part of our cybersecurity service, and you can see comparable anonymised projects in our case studies.

Torn between FortiGate and WatchGuard? Contact us: we reply within 24 business hours.