Fortinet vs Palo Alto vs Cisco: Choosing a Firewall

All three of these vendors make firewalls that will stop what you need stopped. Anyone who tells you one of them is simply the best is either selling it or has not deployed the others. The differences that matter are throughput per riyal, how inspection of encrypted traffic is handled, what the management plane looks like, and how the licensing behaves at renewal.

Read the throughput figures properly

This is the single most common costing error in firewall projects. A datasheet headline number is raw firewall throughput with inspection off. The number you will actually live with is throughput with threat inspection enabled and, critically, with TLS inspection enabled — and that figure is often a small fraction of the headline.

Almost all of your traffic is encrypted. If you intend to inspect it, and for most compliance positions you do, then size against the TLS-inspection number for the specific model. A unit that looks generously specified on the front page of a datasheet can be undersized in practice for the same money.

Where each platform tends to sit

Fortinet builds custom silicon for security processing, and the practical effect is strong inspected throughput for the price, particularly at the branch and mid-range. If you are equipping many sites and the budget is finite, this is usually where the arithmetic lands. FortiOS also spans switching, wireless and endpoint, so a Fortinet firewall can act as the management point for more than the perimeter — valuable if you want fewer consoles, less so if you already have chosen tools elsewhere.

Palo Alto built its reputation on application-level classification and on the depth and clarity of its policy model. Where you have a security team writing detailed, application-aware policy and doing real investigation work, that depth is worth paying for. Where you do not have that team, you are paying for capability you will not exercise.

Cisco firewalls make the most sense inside a Cisco-centric estate, where the firewall is one element of a management and identity model you already run. The integration story is genuinely the reason to choose it. Note that the platform is sold with either ASA or Firepower Threat Defense software, and that choice affects the management model as much as the hardware does — worth settling explicitly rather than accepting whatever is quoted.

Licensing at renewal, not at purchase

Every one of the three sells the appliance and then sells subscriptions for the things that make it a next-generation firewall: threat intelligence, URL filtering, sandboxing, support. The appliance is a minority of five-year cost.

Ask for renewal pricing in writing at the time of the initial quote. Ask specifically what happens to the box when a subscription lapses, because the answers differ. And when comparing bundles, check that you are comparing the same set of services over the same term — bundle composition is where quotes are made to look competitive.

Who operates it matters more than the brand

A well-configured mid-tier firewall administered by someone competent beats a premium platform nobody has time to tune. Before choosing, be honest about who will write the policy, who will review the logs, and who will apply firmware.

If the answer is "nobody, really", then the deciding criterion should be manageability and the availability of a support arrangement, not the depth of the feature set. That is a legitimate answer and it points toward whichever platform your partner can operate for you.

Saudi compliance context

If you fall under the NCA Essential Cybersecurity Controls, the controls will shape your requirements around logging, retention, segmentation and change management. All three vendors can satisfy them. What differs is how much work it is to demonstrate, so ask how each platform produces the evidence an assessor will ask for.

Log residency is worth deciding early. If cloud-based logging or sandboxing sends data outside the Kingdom, establish whether that is acceptable for your sector before it is in the design, not after.

A short decision path

Many branches, finite budget, want one vendor across firewall, switching and Wi-Fi: Fortinet is usually the value answer. A dedicated security team writing granular policy and doing investigation: Palo Alto rewards that investment. An estate already standardised on Cisco with the staff to match: Cisco removes a silo.

Whichever way you lean, size against inspected throughput for your real traffic mix, and get renewal pricing before you sign. We supply Fortinet and Cisco, and will tell you plainly when your requirement points somewhere we do not stock.