NSFW for a Small Enterprise

Posted by brianthebloomfield@reddit | sysadmin | View on Reddit | 168 comments

Just looking to pick the communities brain and have a bit of a fun discussion. Industry is healthcare, an org of 1500 people, 15 locations, 3500ish devices I currently use an active/passive pair of Palo Alto 3220s behind my BGP edge for our perimeter firewall. We've been shopping around, and are looking at Fortinet, specifically the 900G, PAN with the 5410, and Meraki with an MX450. I'll be transparent and say that it was not entirely my decision to end up at this point with picking between these three. I'd be happy to give any additional details I can, but my main question to all of you is, which device would you pick in this scenario, and why? If you wouldn't pick any way and would go another way, why? Once you all weigh in, I'd be happy to share my though on this scenario.

Reply to Post

Reply

168 Comments

[-]

PuzzleheadedElk691@reddit

Honestly thought this was going to be a thread about questionable firewall content, not actual next-gen firewalls. Nice bait and switch.

Reply

[-]

EchoPhi@reddit

TP-Link Omada. It's up and coming with high early adoption success, cost vs feature is outstanding.

Reply

[-]

Clear_ReserveMK@reddit

If you can swing the budget, stick to the palo. If budget is an issue, fortigates are a solid second choice, however be ready to encounter some bugs, and even some critical ones which may need relatively immediate patching. Apart from the patching schedule, fortigates are actually quite solid. I’d stay away from the Meraki. I have a couple of those for my home network, and I don’t think they’re even fit for that. Slight exaggeration with venting my frustration but honestly, you can’t do basic things on them, or if you can, the implementation can be a quite buggy, and sometimes downright unreliable. If you have multiple sites, then yeah the Meraki autovpn makes perfect sense and works very well, but the granularity isn’t there for it to be a proper enterprise firewall.

Reply

[-]

Hollow3ddd@reddit

If you want less headaches, merakis basically run themselves.

Reply

[-]

CatsAreMajorAssholes@reddit

If I have a choice between PAN v Forti, PAN every time. Fortinet isn't bad, it's just not as good as PAN. DO NOT go with Meraki for this scale. It's in a whole different (lower) hemisphere than those 2.

Reply

[-]

ycnz@reddit

It's barely been a week since Fortinet's last critical vulnerability.

Reply

[-]

HRS87@reddit

This, I don't want to consistently be upgrading my firewall on a weekly basis.

Reply

[-]

gamebrigada@reddit

It updates itself, weeks before the vulnerability is even public. People rage about this, and I have yet to care. For the big ones, my sales rep calls me before its public.

Reply

[-]

ycnz@reddit

It's an outage.

Reply

[-]

gamebrigada@reddit

That's on you. If you're requiring 24/7/365 uptime, then you should be setup with HA. Nobody gives a damn in a 9-5 business if everything goes down at 2am for 20 minutes. I sleep like a baby knowing my firewalls are up to date. Seems like you're one of the fools that runs out of date firewalls....

Reply

[-]

ycnz@reddit

No, I don't run fucking fortigate, is my point.

Reply

[-]

gamebrigada@reddit

So you run something else and aren't updating it. PAN-OS totally hasn't had critical vulnerabilities this year /s. They also totally don't update every two months with patches sometimes twice a month for vulnerabilities.

Reply

[-]

ycnz@reddit

You can *count*, right?

Reply

[-]

gamebrigada@reddit

You're just like the news, so sensational. Sure lets count. 7.4.7 came out in January. It was the first "stable" build of 7.4. That's what I'm on. Guess how many critical vulnerabilities have affected me this year? Wrong, its **zero**. Sure lets do 2024!!! Before 7.4.7 was stable I was on 7.2.x! Not a whole lot of criticals for FortiOS in 2024. Lets see. [CVE-2024-21762](https://www.cvedetails.com/cve/CVE-2024-21762/) was published in February. If you were an earlier adopter of 7.2 that one got you. Cool there's one. [CVE-2024-26011](https://www.cvedetails.com/cve/CVE-2024-26011/) released in November, but it affected builds before 7.2.7 and we were already on 7.2.10. Strike out. So I had 1 critical that actually affected me in 2024. But my firewall updated days before it was published. Lets do PAN-OS! 2025 looking good. 2024 not so good. [CVE-2024-0012](https://www.cvedetails.com/cve/CVE-2024-0012/) affected releases that were latest at the time. So did [CVE-2024-3400](https://www.cvedetails.com/cve/CVE-2024-3400/). Looks like you would have updated twice to patch critical vulnerabilities with releases made for the vulnerabilities. So yeah. I can count.

Reply

[-]

ycnz@reddit

I was a service delivery manager for a networking MSP. Fortigates were absolutely the bane of my fucking life.

Reply

[-]

gamebrigada@reddit

In 2020, for a year, for a Fortinet MSP. What experience do you have with any other vendor? MSPs are the reason Fortigates are so looked down upon. Because MSPs don't bother setting up auto updates, don't maintain their customers firewalls, and then their customers abandon them. You're the god damn problem, over here with "relevant experience" that was in 2020 when Fortinet was trading blows with PA every god damn day. Get your shitty attitude out of here.

Reply

[-]

ycnz@reddit

MSPs have to warn their customers when their HA clusters are being bounced. Because, you know, professionalism, and not everyone's 9 to fucking 5. And what makes you think I don't run firewalls now?

Reply

[-]

Reelix@reddit

The problem is that's true most weeks :p[

Reply

[-]

ycnz@reddit

I remember as an account manager, having to explain to a client that yes, the weekend upgrade went well. And that we also needed to schedule a new upgrade.

Reply

[-]

AuroraFireflash@reddit

> DO NOT go with Meraki for this scale Meanwhile we are running Meraki at this scale. Too many vulns with the PAN.

Reply

[-]

thegreatcerebral@reddit

Yea, I wonder why the comment was to not go Meraki?!?

Reply

[-]

Ok_Conclusion5966@reddit

What does PAN offer over Forti? We are thinking of moving away from Forti. How about costs and features/benefits from switching over?

Reply

[-]

srilankanmonkey@reddit

Better performance, granular policies, easier to do l7 policies, better identity based setup, etc. first comment nailed it.

Reply

[-]

gamebrigada@reddit

Better performance is arguable. They're measured differently, Forti measures single use performance, Palo measures average load performance in some cases but not all. Generally when comparing the price competitors like the PA-410 and 70G, Forti wins every time. In some cases by miles because Forti runs their own silicon and hardware accelerates. The 70G has more than 10x the IPSec throughput for example.

Reply

[-]

srilankanmonkey@reddit

Totally fair lots of nuances to dissect for sure. I used to not be able to afford PAN for most clients at an MSP and now bring internal PAN has been great for the network stuff and network segmentation etc.

Reply

[-]

gamebrigada@reddit

Absolutely. If you can afford it, then its totally the better option.

Reply

[-]

gamebrigada@reddit

Palo is only price competitive if you're buying 1 or 2 of the licensed features. If you start stacking Advanced URL filtering, DNS Security, Threat Prevention, SD-WAN, and IoT security onto every firewall you'll realize you're paying more than double.

Reply

[-]

admiralspark@reddit

Agree with this. It's also insanely overkill for the vertical OP is in, but if budget wasn't a concern I'd do PAN. In reality, PAN is not competitive with Forti on pricing, especially at this scale and up, I went through this 6mo ago and was very surprised at how well Forti did.

Reply

[-]

panda_bro@reddit

For performance and features, Palo and it's not even close. Are you an enterprise that tries to save money in some regard? Then Fortinet is a viable option. We use their firewalls and I have truthfully been very happy with them.

Reply

[-]

FuckMississippi@reddit

Also think about the security posture. Fortigate has been an absolute patch nightmare for the last two years. Palo, not so much.

Reply

[-]

PBandCheezWhiz@reddit

Pablo just silently fixed a RCE vuln with out telling anyone. That’s absolute hot garbage. At least with Fortinet, they find a lot their own, publish it in a standard and are completely transparent. Everyone has vulnerabilities, it’s how you hand it that matters.

Reply

[-]

ycnz@reddit

Details of the RCE vuln they fixed?

Reply

[-]

PBandCheezWhiz@reddit

Aleight, this is my case in point right here. The article I got/found was from 2019. I mistakenly thought it was from a lot more recent. And for that. I apologize. But, my timeline still doesn’t change their tactics. https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf So, I admitted I was wrong. And corrected it. Am I more trustworthy or less than if I would have just ignored you? Far less of a scale, but generally the same idea I think.

Reply

[-]

Resident-Artichoke85@reddit

>Response from Palo Alto PSIRT Palo Alto Networks does follow coordinated vulnerability disclosure for security vulnerabilities that are reported to us by external researchers. We do not CVE items found internally and fixed. This issue was previously fixed, but if you find something in a current version, please let us know. If someone else doesn't contact them, why should they CVE for it? Patch and publish. If someone contacts them with the vuln, then they need to CVE. This is very common practice. Newsflash, patch regularly with the vendor's recommended (Palo Alto calls them "preferred") releases. There may be undisclosed fixes. Last month there was a release that had a blank page for resolved items. Nothing should scream louder that that sort of a release. We run into this situation all the time from nearly all of our vendors. Disclosures sometimes come out a month or two later, sometimes years later, and it was already patched and dealt with.

Reply

[-]

neon___cactus@reddit

>At least with Fortinet, they find a lot their own, publish it in a standard and are completely transparent. I've gotten downvoted for saying this in the past but I still believe it. Forti seems to be proactive in finding vulns and publishing the fixes for them rather quickly. All equipment is going to need fixes and maybe I'm too stupid to understand that Forti is truly problematic but it seems to me that they are at least honest and proactive. If we punish companies for transparently publishing the problems with their security, then we will end up with a security culture that hides things instead of fixing things.

Reply

[-]

That_Fixed_It@reddit

Agree. FortiGate automatic update removed our SSL-VPN without warning. The feature was just gone one morning and no one could remote in. No automatic check if the feature is in use. No requirement to acknowledge the loss in functionality before proceeding. No warning other than one line buried in the release notes. We're supposed to use dialup IPsec instead but it doesn't work, after many hours with tech support. We downgraded and have no path forward.

Reply

[-]

neon___cactus@reddit

You should still be able to turn the SSL-VPN feature back on even in the latest updates. It's just hidden under the feature-visibility.

Reply

[-]

That_Fixed_It@reddit

Nope, I looked for that and confirmed with support. We have a 91G with 8GB of RAM. This is from the FortiOS 7.4.8 release notes "The SSL VPN web and tunnel mode feature will not be available from the GUI or the CLI on the FortiGate G-Series Entry-Level models, including 50G, 70G, 90G and variants. Settings will not be upgraded from previous versions. Consider migrating to using IPsec Dialup VPN for remote access."

Reply

[-]

neon___cactus@reddit

Wow, thanks for sharing!

Reply

[-]

Maldiavolo@reddit

Fortinet recommends auto update, but you are crazy to do that. You open yourself up to the situation you are in or a bug making a needed feature not work. Fortinet also told everyone they were removing the SSL-VPN feature several months before it happened. Have you tried migrating to ZTNA? It's the modern alternative to VPN.

Reply

[-]

That_Fixed_It@reddit

They told everyone it was going away for 7.6.x and for 2 GB models, but we have a 91G with 8 GB on 7.4.7. I thought we were safe for a while. Yeah, I turned auto update off now. It was not wildly known that they were going to single out the 90G series and I rarely read the release notes. If I'd done the upgrade manually, I probably would have just confirmed that it worked and we still have Internet. Then I would have left the office without noticing that a core feature is missing. No, I haven't looked at ZTNA. I might have to check it out. I still hope to avoid spending thousands on extra licenses.

Reply

[-]

FrankMFO@reddit

I would agree, Fortinet hasn’t been great for vulns the last couple of years but Palo isn’t far behind them.

Reply

[-]

BIueFaIcon@reddit

The only reason people go to Fortinet is because of cost, and cost only. It is NOT the same quality as the Meraki or PAN. They’re sold a bill of goods when sales folks tell them it has the same features as the top dogs, only to find out a year later that it’s doo doo. Spend the money on the PAN. My only concern with the MX450 is that it’s an older model and you may not get a full lifecycle out of it. Aside from that, there’s lots of benefits with its Advanced Security license. But it’s still better than the Fortinet.

Reply

[-]

Kinglink@reddit

> EDIT: sorry about the title, I meant NGFW 😁 I lost all interest in this topic.

Reply

[-]

roll_for_initiative_@reddit

Thought we were going to see hot firewalls in my area in compromising situations.

Reply

[-]

ilovepolthavemybabie@reddit

Fiery hot firewalls near 127.0.0.1!

Reply

[-]

FireFitKiwi@reddit

I got your loopback penetration tester right here

Reply

[-]

timbotheny26@reddit

This reads like a robot joke from Futurama.

Reply

[-]

yrogerg123@reddit

I heard that interface is always in *promiscuous mode*

Reply

[-]

RedShift9@reddit

I'm more of a ::1 man, those old 127.0.0.1 farts just don't do it for me.

Reply

[-]

420GB@reddit

The problem with most NSFW firewalls is that they all have protection on and only allow certain ports. That's pretty tame and not really interesting to me, you have to really dig for some amateur NSFW firewall material to see something with all ports wide open, getting hammered simultaneously with packages from all over the world.

Reply

[-]

roll_for_initiative_@reddit

A good, home built, really flexible, uninhibited firewall...if you find one like that, that really enjoys routing in and out of every port, well you gotta lock that one up and settle down with it forever.

Reply

[-]

aes_gcm@reddit

I mean its up to you. It turns out that I settled down with a firewall that was a lot more versatile than advertised.

Reply

[-]

aes_gcm@reddit

Watching switches take huge loads is all a bunch of theatrical nonsense. I just watch to watch two switches connect to each other like its something that happens every day, and not just because we have a camera in the server room. It's really not that complicated.

Reply

[-]

yrogerg123@reddit

I used to think like that but my tastes have gotten a bit more depraved. These days I want to see how much that poor little switch can handle.

Reply

[-]

AuroraFireflash@reddit

> hot firewalls in my area in compromising situations That was a few months ago when all the PAs with exposed management UIs got popped.

Reply

[-]

Aboredprogrammr@reddit

/r/cableporn for all that hot physical network action. The competition is L2, but our switches are next level. I'll see myself out. 😁

Reply

[-]

SAugsburger@reddit

I was once explaining to one of my managers what /r/cableporn was and how it was SFW.

Reply

[-]

OptimalCynic@reddit

All our switches are versatile

Reply

[-]

AntiProtagonest@reddit

And their ports are promiscuous.

Reply

[-]

AntiProtagonest@reddit

"What's up step-router".

Reply

[-]

elkab0ng@reddit

I have a wr era; reload fetish now.

Reply

[-]

organicamphetameme@reddit

Syn Flood was my slave name.

Reply

[-]

jacksbox@reddit

In a small environment you probably want to keep your NSFW content limited to inappropriate IMs from people in positions of authority to subordinates. Anything else is overkill and possibly opens you up to unnecessary risks.

Reply

[-]

flecom@reddit

We solved that by making an opt-in distribution group called explicit so people would stop sending offensive content to the all staff list It was an interesting workplace

Reply

[-]

SAugsburger@reddit

Is there specific NSFW topics or is a grab bag of NSFW content where you don't know what you're going to get?

Reply

[-]

Sad-Garage-2642@reddit

It's all hand-drawn pornography of anime characters.

Reply

[-]

SAugsburger@reddit

I thought for /r/sysadmin it was going to the ASCII porn.

Reply

[-]

northrupthebandgeek@reddit

It's 2025; your porn had better be Unicode compliant by now!

Reply

[-]

SAugsburger@reddit

True, we can't be so Western centric anymore. Unicode would allow much more precise images as well.

Reply

[-]

nixub86@reddit

Of course not! r/cableporn it is

Reply

[-]

flecom@reddit

grab bag... a lot was probably stuff that would get you banned from most subreddits though

Reply

[-]

Kinglink@reddit

> keep your NSFW content limited to inappropriate IMs from people in positions of authority to subordinates. If anything, that's the shit you probably want to avoid.

Reply

[-]

phobug@reddit

You can’t fight human nature. Also our systems would be so much more stable and easy to maintain if it wasn’t for all the users.

Reply

[-]

gorramfrakker@reddit

Damn users always usering all over the damn place.

Reply

[-]

ElectroSpore@reddit

Probably better to ask /r/networking/ >I'll be transparent and say that it was not entirely my decision to end up at this point with picking between these three. Those models or those vendors? As Frotinet and PaloAlto are always the top two picks still these days.

Reply

[-]

TU4AR@reddit

Has PA gotten better? I used them for a sprint in 2020-2021 and had nothing but issues with their entire stack especially their Global Protect vpn.

Reply

[-]

hornethacker97@reddit

My org has very few problems with Global Protect and we have a constantly changing cast of remote users as over half our users have the option to take their laptop and work from home at any given time

Reply

[-]

brianthebloomfield@reddit (OP)

I'll be honest, the idea of replacing the 3220 I have with a Meraki kinda scares me. I don't see a continuity of features.

Reply

[-]

dotpeek@reddit

As someone who manages a network of 15 locations in Meraki..I finally just convinced management to dump the Advanced Security licenses and we went with Enterprise MX licenses for routing and Fortigates for scanning traffic. When people are saying Meraki isn't even comparable and that it's that bad. It's not even that it doesn't perform as well. It just literally isn't capable of any meaningful DPI. It's an utter scam honestly.

Reply

[-]

Cormacolinde@reddit

Meraki would be an absolutely huge downgrade security-wise. They’re not even comparable.

Reply

[-]

recordedparadox@reddit

If those are my options, I would probably choose PAN. For real time network monitoring and threat hunting, Barracuda CloudGen Firewall (Firewall Admin managed not web managed) is great. I don’t like the lack of real time network monitoring (I am specifically referring to network traffic flow) in Meraki. If you choose not to go with PAN, Fortinet is a solid choice.

Reply

[-]

imadam71@reddit

You can go with Sophos XGS on this one. Depending on what you use as endpoint, you an rounded up with their MDR. And you can negotiate price. PaloAlto is just a lot of marketing. They have better marketing team, that's for sure. They have 1-2 features better realized then the other but also others have something better. Good with Sophos for your active/passive you pay only one subscription with Sophos.

Reply

[-]

recordedparadox@reddit

Managing BGP with Sophos is best done through the CLI. There is a GUI method but the last time I used it, a number of BGP configuration options were not available in the GUI.

Reply

[-]

headcrap@reddit

So.. Not Good For Work?... lol. We're 500 and run a pair of Palo here, seems fine. You may get a better answer in r/networking

Reply

[-]

Roanoketrees@reddit

Maaaaan....I didnt come.in here to answer some firewall question.

Reply

[-]

YSFKJDGS@reddit

Keep the palos. 15 locations, do they all run the same equipment? Frankly, even in one location a 5410 might be overkill, but you need to look up what you expect for sessions and bandwidth and then map it to the palo docs for throughput with the features enabled. Also you don't really need a 'perimeter' firewall, you can use the same one for both outside and inside, just split the VR's. You want the palo at the core of your network hosting as many vlans as humanly possible.

Reply

[-]

Reelix@reddit

A choice between a critical vulnerability in your network, and complete network loss from a single missed certificate? ... Good luck :|

Reply

[-]

S3xyflanders@reddit

First question is what are you trying to solve for? is your current FW going out of support, are you not happy with Palo? is it too expensive?

Reply

[-]

brianthebloomfield@reddit (OP)

Expense is a factor, we're at the end of a 3 year renewal and the devices are EOL in 2027, so we figured we're gonna make a move or pay out the nose for a renewal.

Reply

[-]

Ok-Warthog2065@reddit

I've always tried to keep stuff going until EOL. You bought it with that EOL in mind surely, why would you throw away usable life of equipment, seems wasteful.

Reply

[-]

Specialist_Cow6468@reddit

It’s not a lot of fun to be under the gun for a firewall migration. Much more pleasant to be able to take your time and ease into it a bit

Reply

[-]

Ok-Warthog2065@reddit

its not like its going to cease functioning the next day. You can easily plan to have a buffer, and even if things take longer than expected be without a safety blanket for a few weeks, or months.

Reply

[-]

Specialist_Cow6468@reddit

There’s plenty of network gear for which I don’t worry about support a ton but a firewall is a very stark exception. They’re devices with relatively high attack surface which are also exposed to the public internet. It just takes one CVE, for which you may or may not have access to a patch, for you to suddenly have a VERY bad day. If there’s consideration for changing vendors 2-3 years from EOL is the perfect time to start planning seriously for the upgrade. It gives you sufficient time to find and test the right product, acquire it, train with it. Enough time for a phased migration rather than a hard cut even

Reply

[-]

DominusDraco@reddit

I mean if you already paid for the licensing before, why would it matter paying it again? Have you gotten quotes for renewals? Palo doesnt usually screw you with renewals, and new devices are cheaper than the licensing costs are. I wouldnt touch Meraki again, but thats just me.

Reply

[-]

n-Ultima@reddit

Why don’t you like Meraki out of curiosity?

Reply

[-]

DominusDraco@reddit

Forget to pay the bill? Network is cut off. You dont renew one device? Whole network is cut off. Merkaki screw up their own licensing? Network is cut off. I dont like to be blackmailed.

Reply

[-]

lifesoxks@reddit

This, time and time, again and again. No license with fortinet? Fine, specific services won't work, but you can still use the network by disabling them. No license with checkpoint? Same as above. Palo? Idk, don't have much experience with them Meraki? You got 400 appliances and one has no license? Fuck you and your network, no way to do anything, nothing works, you cant even access the management portal

Reply

[-]

SystemSalt@reddit

in my opinion, Meraki is amazing for chain stores and hotels. The ease of configuration and management is a breeze. If you need anything more technical or security features its limited. It Allows you to manage multiple sites with a smaller IT team. Anytime you want to use one of their more advanced features. It’s either extremely lacking or there are bugs. They promise they will fix but two years later it sitting as a Known Issue. (Looking at you 802.1x and Group Based Access Policies), Plus he mentioned cost issues, the way Meraki is set up it almost vendor locks you and forces you to pay or your network goes down. I’d recommend a Palo + a switch that supports stateful sessions for a router, and same brand access switches in this recommended setup.

Reply

[-]

sryan2k1@reddit

Going from Palo Alto to Meraki for security is like trading in your paid off 911 Turbo for a lease on a 20 year old Ford focus.

Reply

[-]

Slashdotted20@reddit

This 🤣 PAN 5400 series all day.

Reply

[-]

illicITparameters@reddit

Meraki Securiry Appliances are best suited for smaller orgs. I wouldnt even use one for a single location 3000 device network.

Reply

[-]

Wolfpack87@reddit

Also a Meraki diehard, but this isn't the use case for it.

Reply

[-]

Cautious_Winner298@reddit

Fuck meraki!

Reply

[-]

BigChubs1@reddit

This is the way

Reply

[-]

brianthebloomfield@reddit (OP)

I have gotten quotes, leadership isn't feeling the renewal or even a refresh at the current price and the current economic climate we're in.

Reply

[-]

dracotrapnet@reddit

PAN, since I use PAN. Our workflows are already built around PAN, logs are shipped daily to a file drop server, one guy figured out the api and built a powershell script to pull client names on the globalprotect vpn that any helpdesk tech can query. Now if all I did day in and day out was NGFW, I could spend time installing another brand NGFW somewhere and trialing it. I just don't have the bandwidth or time. There's so much more going on in my stack, PAN I don't have to constantly monitor and tweak.

Reply

[-]

rabbitsnake@reddit

We did a review of NGFW/SASE/SDWAN/VPN vendors 2 years ago and went with Cato Networks. They are younger company, but the founder started Checkpoint back in the day. We are immensely pleased with their offering and they are continually adding and improving features.

Reply

[-]

Avas_Accumulator@reddit

Yeah, something modern to cover people on and off the premise in the most modern way is the way to go.

Reply

[-]

FrankMFO@reddit

Agreed, I would be swapping out Meraki for Cato in the OP’s list and then evaluating between Forti, Palo and Cato for his use case.

Reply

[-]

trebuchetdoomsday@reddit

seconding Cato, good luck with Fortinet & Meraki :/

Reply

[-]

tuvar_hiede@reddit

I love Meraki, but not as an edge firewall. They work great in small environments with SDWAN, but Palo is still king in these situations. I've been unimpressed with Forti. I dont care for their management, I've had several randomly fail on me, pricing is high for what you get, and it feels like I see them release a lot of critical issues. Palo is expensive, but it's highly regarded and well supported.

Reply

[-]

Ok_Programmer4949@reddit

We use Barracuda ngfw devices for our clients that require more stringent security. Specifically healthcare and law enforcement. Larger sites get an F180, satellites an F18. I have noticed that it seems to be able to do just about anything we have needed, and certainly is more feature rich than Meraki, but the learning curve is somewhat steep.

Reply

[-]

PaleCommunication782@reddit

I would stick with PAN. Redesigning everything with a differnt vendor is a huge hassle. The 5410 might be a bit overkill, check if 3400 series devices have enough throughput.

Reply

[-]

t00sl0w@reddit

NSFW and Healthcare, first thought was maybe you wanted to allow adult stuff to certain people on your network. Our sec team was kind made to allow it for field physicians, nursing staff and some of the investigative scientists so they can use videos to allow people to show or tell them things they may not be able to communicate.

Reply

[-]

EmptyM_@reddit

> EDIT: sorry about the title, I meant NGFW 😁 Ye ole bait and switch…. I’ve Fortinet in the past, solid product. But at the moment in my job we have PA’s and I have zero complaints with them…

Reply

[-]

svecccc@reddit

Had 2 x MX450 running in HA due to a decision by my predecessor. I would never willingly go back to using MX appliances again, and that's speaking as someone who had no prior experience of them.

Reply

[-]

mahsab@reddit

Small Enterprise? 1500 people is more like a homelab /s

Reply

[-]

WithAnAitchDammit@reddit

I’d say PAN all the way. We just upgraded our 3220’s for 3410’s six months ago. With 3yr licenses, it ended up being less expensive than renewing licenses and support for three years. Curious why the PA-5400 series and not the PA-3400 series.

Reply

[-]

tippenring@reddit

Meraki in healthcare? Are they signing BAAs now? They can obtain packet captures and have remote access to your network at any time, so you need to be cautious.

Reply

[-]

patdan69@reddit

Meraki makes it incredibly easy to manage and scale, but at your scale, you will need to know how to use their API to avoid deployment configurations using their GUI. GUI is great for smaller deployments and one-off issues, but not at that scale. If you know what you're doing, you can write scripts to configure the devices quickly using APIs, and the setup and management is damn easy once deployed. I've had Meraki IPS discover and stop malicious traffic on a network not managed by us simply because we forced the contractors to use a Meraki-based VPN (to a vMX). I'm not even sure the contracting company would have discovered it if it wasn't for our actions.

Reply

[-]

ntrlsur@reddit

I would stay with Palo Alto.. The good stuff aint cheap..

Reply

[-]

WithAnAitchDammit@reddit

And the cheap stuff ain’t good.

Reply

[-]

bottombracketak@reddit

3220 is EOL 8/31/2028. The migration path is to the 3400 series, but I would take a hard look at your utilization because you might be fine with moving to 1400 series. When you go to renew, tell your sales rep you’re looking at the other options and press them hard. They can always get you deeper discounts. Since you have some time, take some of the free coursework that Fortinet offers, and maybe get a PoC demo that you can run some real traffic through. The Fortinet will almost certainly come in cheaper Gig for Gig of inspection. There are plenty of much larger orgs running them. I would not go with Meraki for this. Their functionality is too limited for an enterprise edge. Palo is pretty good but it’s top of the price bracket. Every vendor has their flubs, you just have to stay on top of the bulletins and be ready to mitigate in a worst case scenario.

Reply

[-]

Electronic-Piano-504@reddit

Fortinet is hot hot garbage, please consider not supporting a company that doesn't give a sh** about security updates and safe firmware programming.

Reply

[-]

brianthebloomfield@reddit (OP)

I used a 100D a few years ago, and it seemed solid, but that was in a small medium business scenario, one site, 100 users.

Reply

[-]

WilfredGrundlesnatch@reddit

They've had a shitload of critical vulnerabilities in the last few years. If you don't mind having to drop everything and do an unscheduled outage for emergency patching several times a year, they're not bad.

Reply

[-]

charmin_7@reddit

That title is hilarious. We switched from Palo to sophos about three years ago. Palo is nice, but sophos is much easier to manage for us and I like the heartbeat feature if you run interceptX as well (e.g. allow access only with a green heartbeat and so on).

Reply

[-]

SystemSalt@reddit

In my experience, Palo Alto is the superior option—yes, it’s expensive, but it’s reliable and doesn’t require constant maintenance. If your environment is relatively static, it just works. Meraki shines in large, distributed deployments (50+ sites) with standardized setups—restaurants, retail chains, etc.—especially if you’re all-in on the Meraki stack. The ease of management and device replacement with active licensing is a plus. That said, I have concerns about the licensing model: when it expires, your network functionality drops significantly, and the hardware becomes effectively useless. I can’t speak directly to Fortinet, but I’d suggest reviewing their recent vulnerability disclosures. The volume and severity of issues being reported could either reflect thorough internal audits—or worse, that exploits are being discovered after the fact. (yes i used ChatGPT to format my ramblings)

Reply

[-]

Sea_Fault4770@reddit

I will say Sophos XGS series. They have a ton of features that come with the device, including DNS protection and live threat feeds at no extra cost.

Reply

[-]

notdedicated@reddit

We went Sophos XGS and it's been great. Very price competitive! We added the ZTNA services which has been nice for some of our external contractor teams. We had to deploy a software firewall to our AWS env to support ZTNA which is annoying but it is what it is. I would recommend Sophos to anyone who asked.

Reply

[-]

DominusDraco@reddit

Why would you go from a top tier firewall to a mid tier firewall like a Fortinet?

Reply

[-]

brianthebloomfield@reddit (OP)

$$$ and leadership thinking Meraki and Cisco Umbrella is a comparable/more cost effective solution.

Reply

[-]

BBQ-4-Life@reddit

Main thing on Meraki is if you have more than one external IP per physical interface. They don’t support that yet

Reply

[-]

brianthebloomfield@reddit (OP)

We have a public /24, so that's pretty gross...

Reply

[-]

BBQ-4-Life@reddit

Yea. Massive miss on Meraki. Not sure why they haven’t fixed that yet

Reply

[-]

50YearsofFailure@reddit

I'm not surprised. For the price I was blown away that they didn't have FQDN as an option in firewall rules. In an age of elastic clusters, Cloudflare, and dynamic WAN somehow this wasn't a feature until last year or so. Hell, I remember configuring a low-rent Sonicwall back around 2012 that had FQDN objects.

Reply

[-]

pmormr@reddit

It's a completely non-comparable product to a Palo. Meraki's great at basic cookie cutter stuff that fits their model (think like retail deployments, satellite offices, etc.), but as soon as you stray from it it becomes a gigantic pain. Also, been a while since I looked at pricing for the MX's, but those renewals are not cheap.

Reply

[-]

PayNo9177@reddit

You can assign additional IPs with 1:Many NAT or port forwarding rules, but it’s not quite the same.

Reply

[-]

Lerxst-2112@reddit

Wow, didn’t know that. That’s crazy

Reply

[-]

willyougiveittome@reddit

That’s still a problem?!? I remember last dealing with that limitation well over a decade ago and thought that Cisco would get around to fixing that. Incredible.

Reply

[-]

FuckMississippi@reddit

They ok with meraki being a subscription product? As in, if you stop paying maintenance it stops routing packets.

Reply

[-]

brianthebloomfield@reddit (OP)

Apparently :/

Reply

[-]

odaf@reddit

Meraki is great for beginners or jack of all trades but expensive and somewhat limited in features. Cisco umbrella isn’t bad at all combined with fortinet because it gives 100% visibility without VPN.

Reply

[-]

decoy713@reddit

Not fortinet based on issues we had and their security being pretty lax

Reply

[-]

Beef410@reddit

Do you actually need the "new" 3220? Newer stuff has larger capacities and you may be able to "downgrade" to a cheaper model. Worth reviewing spec sheets

Reply

[-]

onawave12@reddit

stick with PA. The amount of vulnerabilities forti gets is just insane.

Reply

[-]

slyfox49@reddit

Have you looked at watchguard at all? They are good devices that won't break the bank.

Reply

[-]

GO-Away_1234@reddit

Controversial opinion: You don’t need a NGFW

Reply

[-]

Sasataf12@reddit

That's like saying you don't need a strong password if your MFA is working. Security in layers.

Reply

[-]

Fatality@reddit

Yes that's how passwordless works

Reply

[-]

Sasataf12@reddit

Not all systems support passwordless auth.

Reply

[-]

GO-Away_1234@reddit

Many websites are password-less if you use FIDO2 but we’re getting off topic here. If you lock down your endpoints enough I honestly think they are useless, most don’t even scan for ELF binaries but their blocking of Win32 bins is an impressive demo for the boardroom.

Reply

[-]

Sasataf12@reddit

Even then, having one strong layer of security doesn't negate the need for all others. Like I said, security in layers.

Reply

[-]

Wolfpack87@reddit

Honestly, I'd stick with PA. Get a new pair if you feel yours are too old or not doing what you want. (I suggest active-active to make the investment worth it). Meraki is wrong for this usecase. Fortigate is a huge step down. Source: 25 years in networking, a CCIE, and 6 years in Hospital IT.

Reply

[-]

lweinmunson@reddit

Fortinet tends to be less expensive, Palo is mid priced, but I love their software and license model. Meraki is Cisco and Cisco firewalls have been a bunch of bolt on acquisitions on top of each other. I don't know how much code the Meraki shares with the Firepower, but the price/performance for Cisco hasn't been there for me. Most of the time I feel like I've been waiting on Cisco to put their gold star on an experimental release to fix real bugs I'm running into, and then waiting on the next one to fix the next set of bugs. I got my Palo's on version 11.1 out of the box, and I haven't had any issues with them.

Reply

[-]

N805DN@reddit

Meraki MX compared to Palo is like a Fisher-Price My First Firewall.

Reply

[-]

didact@reddit

So at your edge doing everything? If I'm buying one thing to do everything, it's certainly PAN. And that's going to be the most expensive. But, I've got one contract to get on 4hr parts and premium support, executives can make choices on xdr, siem, ir retainer, and other stuff under the same relationship and I can live with the results/lack of results as decided.

Reply

[-]

caponewgp420@reddit

I’ve got a few Fortigates, 1 Palo and 1 small Meraki MX right now and I would probably keep Palo if you have the funds. Definitely don’t go with the Meraki. I prefer Fortigate but if you have Palo now I would stay there. I really like how good Palo is at app identification.

Reply

[-]

brianthebloomfield@reddit (OP)

A lot of my policies are built around the zones I've created and application detection. Worried how this will translate either way 😂

Reply

[-]

pootiel0ver@reddit

Here's your answer right here. You will have to re-visit all of that moving to Fortinet. I wouldn't even consider Meraki.

Reply

[-]

illicITparameters@reddit

Not the Meraki. I like Fortinet, but if price is similar go Palo.

Reply

[-]

MyBrainReallyHurts@reddit

They aren't taking all the costs into consideration. Sure, the device may be a little higher to purchase, but it will be a smooth transition. If they switching there is learning, reconfiguring, waiting for something to break because you forgot a policy or doesn't work on the new device and no one can figure out why. Tell them to also factor in a week of your salary to reconfigure and switch devices. Or two hours if you stay with Palo Alto.

Reply

[-]

WorkLurkerThrowaway@reddit

Honestly a week almost seems generous

Reply

[-]

DevinSysAdmin@reddit

Id recommend Fortigate.

Reply

[-]

splntz@reddit

I didn't like Meraki at first seems like a heavy price, but it's just so convenient and if it for some reason dies or has another issue they just ship you a new one. I'd buy more if needed.

Reply

[-]

DobermanCavalry@reddit

Meraki is fantastic if you dont have dedicated network teams because it dumbs things down/makes it quick to manage in one easy pane of glass. Its not inexpensive but I dont know how it compares to whatever your costs are on the Palo Altos. If the Meraki feature set suits your needs it can really work, but I dont think its the best choice for a lot of people.

Reply

[-]

XxVALKENxX@reddit

Personally I go with Fortinet for the simplicity of the UI and integration into other Fortinet systems. I don't run a lot of in house applications and zero Linux, exchange servers etc so Meraki doesn't make sense. I could see an argument to stick with Palo or move to Forticlient.

Reply