Inherited network in a bad state. which brand do I pick for hardware refresh in my situation?

Posted by Due-Swimming3221@reddit | sysadmin | View on Reddit | 61 comments

Hey all. Just taken on an IT manager role and inherited infrastructure that needs some work. gonna propose a hardware refresh and want some outside input before the quotes come through. The setup: * 10 sites, head office plus 9 remote construction cabins * All sites running SonicWall firewalls, Netgear switches, Unifi APs * Head office is different, it's been refreshed already and is all Unifi (switches, APs, CloudKey) * Only 2 of the SonicWalls are still in support, so the rest need replacing Our VAR is quoting us on three options: SonicWall, Fortinet, and Unifi. * SonicWall - already in place everywhere, and 2 units don't need replacing at all since they're still current. Least disruption by far. Also our end users are already using SonicWall's client VPN for accessing our fileserver. * Fortinet - I came from a Fortigate environment so I actually know my way around it a bit. Not sure how much weight to give that when making the call though. * Unifi - apparently the cheapest option and would tie everything in with the head office setup. Main concern I keep hearing is that it's not really up to scratch as a proper security appliance according to industry friends who know networking and security better than I do, specifically around tweaking IPS and web filtering. Not sure if that's a fair criticism , as im taking their word for it networking isn't my strongest area. Is Unifi actually viable for a setup like this or is it more of a home/prosumer thing? And is the familiarity argument for Fortinet actually worth anything in practice? the VAR seems to think Unifi will be my best bet and doesn't place too much importance on the lack of tweaking ability for security policies etc. as that's more an endpoint configuration thing nowadays and it's irrelevant when people work from home. but that statement "feels" like a copout, I just cant articulate why opinions greatly appreciated as this'll be a costly change and I am motivated to get it right. Thanks so much in advance

Reply to Post

61 Comments

[-]

Alert-Mud-8650@reddit

Having used all three I would pick Unifi. Sonicwall and Fortigate may have more features but that also leads to more zero day vulnerabilities. And if you don't patch upgrade quick enough you will get hacked. Unifi is easier to manage, with the control software that doesn't cost an extra subscription. Fortigate cloud Portal access for their devices but I prefer the Unifi. I used to not used the unifi gateways but they have gotten alot better.

[-]

Horsemeatburger@reddit

>Sonicwall and Fortigate may have more features but that also leads to more zero day vulnerabilities. That's quite frankly a silly take. Aside from the fact that most CVEs found in Fortinet code has been found by Fortinet themselves (because they are still the only vendor who's research labs put their own code under the same scrutiny as they do with other code), the absence of CVEs doesn't mean something is more secure. It just means there are very likely a lot more vulnerabilities which haven't discovered yet. Following your logic, the best thing to do would be to remove the firewall entirely, because a firewall that doesn't exist can't have any vulnerabilities. This is not how security works.

[-]

Alert-Mud-8650@reddit

My issue is the one thing firewall is supposed to do is prevent unauthorized connections from the internet Sonicwall and Fortigate has historically failed while Unifi has been successful. You have commented that things that in your mind makes fortigate more secure but you have not provided anything to Unifi being less secure. If the firewall prevents unauthorized connections then it is secure all the other stuff that Fortigate does may impress you, but means nothing to me. if it lets hackers into a network enough to execute ransomware via a vpn cve.

[-]

Horsemeatburger@reddit

>My issue is the one thing firewall is supposed to do is prevent unauthorized connections from the internet Sonicwall and Fortigate has historically failed while Unifi has been successful. Yeah, you'll have to privide some proof for this claim, as it's little more than nonsense. >If the firewall prevents unauthorized connections then it is secure all the other stuff that Fortigate does may impress you, but means nothing to me. if it lets hackers into a network enough to execute ransomware via a vpn cve. Yeah, sure. At the moment I'm not sure whether you're genuinely naive or whether that's copium from a Ubiquiti fanboi. In any case, I really hope you're not let anywhere near important security infrastructure.

[-]

Alert-Mud-8650@reddit

https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-rce-flaws-in-fortisandbox-and-fortiauthenticator/

[-]

sotech117@reddit

The unifi fabric tools will save you a ton of time with meshing sites. I deploy unifi for most projects now unless the client asks for something specific. Just safe a lot of time in general, and its software has mostly caught up in 2026

[-]

monkeyreddit@reddit

Construction cabins, I’m going to have to start using that instead of trailer

[-]

Stephen_Dann@reddit

As you know Fortigate, go with them. They are generally good solid kit. I like their CLI Unfi/Ubiquti, I like their kit and management, use them at home. However I have found them lacking for support at times and think their security isn't always as up to date as others. It is a shame as I think they are almost there for being an enterprise level company and hope they do become that. Sonicwall. Had so many problems with Macs, phones and printers over the years that I would rather not deal with them.

[-]

Alert-Mud-8650@reddit

I'm curious how unifi security is not up to date? I would argue that while the may not have as many "security" settings options as a fortigate they also don't have regular zero day security vulnerabilities, the fortigate has history of.

[-]

Stephen_Dann@reddit

They have had zero day security exploits. They are not as well covered as Fortigate. So not as much in the news. Similar to Microsoft and Apple, all have their faults but everyone chases Microsoft as they are the more prominent company. I like Uifi, think they are good. So not trying to criticise them, just think they need to improve their offerings

[-]

Alert-Mud-8650@reddit

The only zeroday for unifi I am aware of was the log4j back in 2021, which also affected lots of other systems.

[-]

Horsemeatburger@reddit

\>The only zeroday for unifi I am aware of was the log4j back in 2021, which also affected lots of other systems. Yeah, no, there were others, such as these CVE/Vulnerability | Impact/Severity | Discovery Date | Patch Date | Days to Fix * Sharp Incident | Infrastructure/Credential Theft | 2020-12-01 | 2021-03-31 | **120** * CSRF Bypass | Session Hijacking (6.3) | 2015-03-10 | 2015-10-02 | **206** The embarrassing bit here is the days to fix. And of course, those were not the only critical vulnerabilities UBNT had. From a quick search: CVE/Vulnerability | Impact/Severity | Discovery Date | Patch Date | Days to Fix * CVE-2026-22557 | Path Traversal Account Takeover (10.0) | 2026-03-01 | 2026-03-18 | 17 * CVE-2025-23123 | Heap Overflow RCE (10.0) | 2024-11-20 | 2026-03-11 | **476** (yes, really!) * CVE-2025-23116 | Authentication Bypass (9.8) | 2025-02-18 | 2025-02-28 | 10 * CVE-2025-23117 | Firmware Validation RCE (6.8) | 2025-02-18 | 2025-03-03 | 13 * Cloud Leak | Privacy Breach (Unauthorized View) | 2023-12-13 | 2023-12-15 | 2 * Cloud-side CVE-2023-28365 | Backup Restore RCE (9.1) | 2023-04-15 | 2023-06-08 | 54 * CVE-2021-44530 | Local Privilege Escalation (7.8) | 2021-09-10 | 2021-12-07 | 88 There might well be others, as I couldn't be bothered to check further.

[-]

Alert-Mud-8650@reddit

Thanks for doing the research to confirm my point these vulnerabilities do not qualify as firewall zeroday vulnerabilities and while the issues should have been fixed in a more timely matter my network was never at any risk behind and unifi gateway. However Sonicwall and Fortigate leave their customers network at risk do to their zerodays.

[-]

Horsemeatburger@reddit

>Thanks for doing the research to confirm my point these vulnerabilities do not qualify as firewall zeroday vulnerabilities This is little more than wishful thinking. For example, Cloud Leak most certainly affected firewalls because it was an SSO/Account level breach. Since most modern UniFi routers are managed via a Ubiquiti cloud account, This zero day allowed strangers to potentially access settings on other users' routers and network consoles. CVE-2026-22557 was a critical vulnerability in the UniFi Network Application, and because it controls essentially all UniFi routers, the vulnerability allowed an attacker to hijack the application to control the router and the entire local network. And that's just two examples. >However Sonicwall and Fortigate leave their customers network at risk do to their zerodays. No, they don't. That's why CVEs are published and fixed. As I said in another comment, security doesn't work the way to seem to imagine.

[-]

Alert-Mud-8650@reddit

I'm specifically talking about zero days do you understand what a zero day. CVEs which are issues reported by hacker one to unifi and then they fixed it before any customer was at risk is not the same as a zero day where hackers are actively hacking into Ford Gates and Sonic walls and that's when the issue was found. The CVE with the network application issue the hacker has to be already has to be on the Network which isn't as concern for me as people from other countries hacking into my network

[-]

Horsemeatburger@reddit

>I'm specifically talking about zero days do you understand what a zero day. I know what a zero day is, seems it's you who is confused here. For example, CVE-2021-44530 (the Log4j you mentioned as being the only zero day you said you were off, remember?) is a zero day. >CVEs which are issues reported by hacker one to unifi and then they fixed it before any customer was at risk is not the same as a zero day Well, Cloud Leak was a zero day, because it was already exploited, so that's one. The Sharp Incident was another, and here UBNT took 120 days to fix it. You're grasping at straws here. >is not the same as a zero day where hackers are actively hacking into Ford Gates and Sonic walls and that's when the issue was found. Yeah, no. Hackers were able to hack into Fortigates because their owners failed to install firmware updates which have been available in some cases for more than a year. I know I'm sounding like a broken record here, but you don't know what you're talking about. You overly simplistic view is not rooted in reality.

[-]

Alert-Mud-8650@reddit

No, I actually looked at the CVE and security incidents, and evaluate how they affect my network and they don't. Mean while, I was called in to help with a ransom incident and it was discovered that the hackers got in via Fortigate VPN. And guess what Fortinet's "fix" is just turn off the VPN. Yeah, good luck spinning that as better security.

[-]

Horsemeatburger@reddit

>I'm curious how unifi security is not up to date? UBNT's enterprise gateways (ESGs) are basic SPI firewalls and routers which have bolted-on basic IDS/IDP, web filtering and some honeypot, implemented as software on top of a low-cost low-power CPU platform. There is no hardware support for encryption, so with full NeXT AI (SSL/TLS) Inspection (which isn't even full DPI, it's an inspection of packet headers only) performance drops like a rock because the CPU has to handle all in software. The ECG firewall itself is based on simple zone based rulesets and application toggles which doesn't provide a lot of granularity. There's also no true heuristic sandboxing (there's only a simple cloud-based metadata check against hashes of known bad files), no complex SD-WAN, no ZeroTrust, and it can only block file types by categories (such as P2P), not by actual file type. Everything in the ESG is pretty basic. Security-wise, there's nothing in the ECG you couldn't achieve with open source firewalls such as OPNsense. In comparison, Fortigates, like devices from other big security vendors, are advanced NGFWs with hardware acceleration via Forinet developed ASICs (NPs). They can perform full DPI in hardware. The rulesets are way more granular than what you can define on ESGs (Fortigates can do user-based, device-based, and application-specific policies with micro-segmentation), they can do heuristic malware analysis via sandboxing (they run the code in sacrificial Windows/Linux environments to study their behavior), they can do advanced SD-WAN and ZeroTrust, it can perform virtual patching (i.e. close software vulnerabilities in unpatched software) and a long list of other stuff nothing Ubiquiti makes is capable of. Then there's the company behind it. Fortinet operates a very large in-house threat intelligence organization (one of the largest in the world). They do original research, discover zero-day vulnerabilities, and write their own signatures for IPS, AV, and Sandbox. This is the same for every enterprise security vendor - Palo Alto, Sophos, Sonicwall, Checkpoint, Cisco - they all run their own security research organizations to find vulnerabilities and discover new threats. While UBNT has to license threat signatures from Proofpoint and content filtering lists from Cloudflare for its "CyberSecure" service, because they have zero in-house security expertise. >I would argue that while the may not have as many "security" settings options as a fortigate they also don't have regular zero day security vulnerabilities, the fortigate has history of. Ubiquiti Protect also has seen a number of vulnerabilities, and while UBNT is usually quick fixing vulnerabilities in the cloud infrastructure, fixing vulnerabilities in their firmware however usually takes 2-3 months, sometimes more (in one case even over a year), often even *after* the vulnerability already became public. Also, as mentioned in another comment, the number of CVEs is no indicator about how secure a product is. After all, a CVE means a problem was found, identified and, in most cases, fixed. The absence of CVEs doesn't mean the product is more secure, it just means there is likely a large number of vulnerabilities which haven't been discovered yet (at least not by the good guys).

[-]

nav13eh@reddit

Every vendor has had huge vulnerabilities. Ubiquiti, Fortinet and yes even Palo just this week. They will be as secure or insecure as you configure.

[-]

Horsemeatburger@reddit

>I'm curious how unifi security is not up to date? UBNT's enterprise gateways (ESGs) are basic SPI firewalls and routers which have bolted-on basic IDS/IDP, web filtering and some honeypot, implemented as software on top of a low-cost low-power CPU platform. There is no hardware support for encryption, so with full NeXT AI (SSL/TLS) Inspection (which isn't even full DPI, it's an inspection of packet headers only) performance drops like a rock because the CPU has to handle all in software. The ECG firewall itself is based on simple zone based rulesets and application toggles which doesn't provide a lot of granularity. There's also no true heuristic sandboxing (there's only a simple cloud-based metadata check against hashes of known bad files), no complex SD-WAN, no ZeroTrust, and it can only block file types by categories (such as P2P), not by actual file type. Everything in the ESG is pretty basic. Security-wise, there's nothing in the ECG you couldn't achieve with open source firewalls such as OPNsense. In comparison, Fortigates, like devices from other big security vendors, are advanced NGFWs with hardware acceleration via Forinet developed ASICs (NPs). They can perform full DPI in hardware. The rulesets are way more granular than what you can define on ESGs (Fortigates can do user-based, device-based, and application-specific policies with micro-segmentation), they can do heuristic malware analysis via sandboxing (they run the code in sacrificial Windows/Linux environments to study their behavior), they can do advanced SD-WAN and ZeroTrust, it can perform virtual patching (i.e. close software vulnerabilities in unpatched software) and a long list of other stuff nothing Ubiquiti makes is capable of. Then there's the company behind it. Fortinet operates a very large in-house threat intelligence organization (one of the largest in the world). They do original research, discover zero-day vulnerabilities, and write their own signatures for IPS, AV, and Sandbox. This is the same for every enterprise security vendor - Palo Alto, Sophos, Sonicwall, Checkpoint, Cisco - they all run their own security research organizations to find vulnerabilities and discover new threats. While UBNT has to license threat signatures from Proofpoint and content filtering lists from Cloudflare for its "CyberSecure" service, because they have zero in-house security expertise. >I would argue that while the may not have as many "security" settings options as a fortigate they also don't have regular zero day security vulnerabilities, the fortigate has history of. Ubiquiti Protect also has seen a number of vulnerabilities, and while UBNT is usually quick fixing vulnerabilities in the cloud infrastructure, fixing vulnerabilities in their firmware however usually takes 2-3 months, sometimes more (in one case even over a year). Also, as mentioned in another comment, the number of CVEs is no indicator about how secure a product is. After all, a CVE means a problem was found, identified and, in most cases, fixed. The absence of CVEs doesn't mean the product is more secure, it just means there is likely a large number of vulnerabilities which haven't been discovered yet (at least not by the good guys).

[-]

nav13eh@reddit

I think this comment reply was meant for someone else.

[-]

Horsemeatburger@reddit

Indeed, for some reason it seemed to have shifted a level down. Damn.

[-]

Horsemeatburger@reddit

>Unifi - apparently the cheapest option and would tie everything in with the head office setup. Main concern I keep hearing is that it's not really up to scratch as a proper security appliance according to industry friends who know networking and security better than I do, There just was another discussion about Ubiquiti in the enterprise sector, where I posted a longer response about Ubiquiti: https://www.reddit.com/r/sysadmin/comments/1t7cpyy/comment/oksq0tr/?context=3 The short answer is that your friends are right, Ubiquiti is a vendor which makes prosumer and "enthusiast" equipment while trying to pose as enterprise vendor. Security-wise, Ubiquiti buys in external signatures from Proofpoint and Cloudflare since, unlike the big security vendors, they have no own security expertise. Also, support is between poor to non-existent. To be fair, their access points work well compared to consumer WiFi kit, and the central management and the polished UX is very slick, however it's still not at the same level as kit from Aruba, Ruckus or Juniper, or even Fortinet's APs. >Our VAR is quoting us on three options: SonicWall, Fortinet, and Unifi. >SonicWall >Fortinet >Unifi Leaving Ubiquiti aside, the only decent choice here is Fortinet, although they are now also one of the pricier options. Sonicwall used to be great before Dell bought them, since then they have fallen behind everyone else. Another option could be Sophos XGS, which works pretty well, and prices are lower than Fortinet's. We have a few remote sites on them, and they perform very well (we're mostly a Fortinet/Palo Alto shop).

[-]

zantehood@reddit

Fortigate is decent. We went from palo alto to fortigate.

[-]

grv144@reddit

How the Forti support is in comparison to Palo?

[-]

zantehood@reddit

Generally i think palo alto is the better platform, but also moe expensive. I seriously dislike global protect (palo alto VPN) and so does our security team. Forti IPSEC vpn is decent when you get used to it, even if the free client is a bit shitty.

[-]

Shaidreas@reddit

Out of curiosity, why do you dislike Global Protect?

[-]

zantehood@reddit

Client is heavy, updates have been very fragile for us, and our security team has been shitting on it for years

[-]

grv144@reddit

Are you able to tell why there were shitting on GP and if you have any experience with Prisma Browser vs GP?

[-]

zantehood@reddit

I cant remember the details; but they thought we could do better in terms of security. And no

[-]

grv144@reddit

I remember there were certificate chain security issues in the past. Thank you for replies. I’m in Palo world, but their current support strongly piach me into Forti hands 🤣

[-]

zantehood@reddit

Ive really only used to community forums for support, which was great. Never logged an official ticket.

[-]

grv144@reddit

Yeah, I used to manage Palo with community support, but now with Prisma Access where I have no access to backend CLI, I’m pleased with the TAC

[-]

nav13eh@reddit

It's not exceptional but ok. Fortinet is easier to manage though.

[-]

Alert-Mud-8650@reddit

My experience with fortigate is that their support is not very helpful they just send you the documentation that you already had which didn't help. I found videos on YouTube that were more help than support.

[-]

Embarrassed-Gur7301@reddit

Fortigate is, Palo Alto is better

[-]

Expensive_Plant_9530@reddit

Sure of course, but Palo is also one of the most expensive options. IMO Fortinet products are extremely good value for the price.

[-]

Select-Cycle8084@reddit

Unifi is fine for switching/APs I would not use them for an Edge Firewall for a SMB of your size. For 10 offices, it seems like you would have a networking guy. I'd recommend Fortinet of the 3 options presented.

[-]

Logical_Sort_3742@reddit

Agree on Unifi. It is more consumer grade than business imo, and you will be spending valuable time fixing what shouldn't need to be fixed.

[-]

Previous-Low4715@reddit

I run over 100 sites for a single org on Unifi. Very recently they’ve announced a raft of features to properly manage sites at scale, it’s called Unifi Fabrics.

[-]

beren0073@reddit

How do you deal with their lack of guaranteed next business day replacement hardware? You can buy a plan that promises they'll ship without waiting to receive yours, if they have stock available.

[-]

Previous-Low4715@reddit

Keep spares with zero touch config. It’s been a journey, I took over this place five years ago and we’ve been managing 100+ sites with zero scalability up to now. Unifi fabrics solved that issue at least.

[-]

Alert-Mud-8650@reddit

By spares they are cheap enough and the failure rate is not that high

[-]

nav13eh@reddit

Unifi is more capable at this scale than you give it credit for. It'll likely lower the management overhead enough be worth it. Fortinet is an excellent option if he needs something just a bit more powerful.

[-]

Alert-Mud-8650@reddit

It is not 10 offices. It is 1 office with 9 remote sites, which he called remote construction cabin, we don't know how big these cabins are. It could as simple 1 computer and a printer, hardly needing anything fancy other then internet and probably a vpn back to the office.

[-]

Aless-dc@reddit

Fortinet firewalls. Unifi APs/switches. Fortinet can all be managed together via fortimanager, and offers good and easy vpn services Unifi aps and switches can all be cloud managed easily

[-]

mods_are_lame1@reddit

Of those three? Fortinet, and it’s not close. I’d also look at juniper and Aruba. Aruba has real nice switches at fair prices, no license bullshit. Aruba Instant On if cost is a concern.

[-]

silkee5521@reddit

If it were me and I didn't want to work with something complex or maybe just a little difficult to understand the way they do things, I would go Fortinet for the firewall and Azruba for the switches and APs. Palo Alto is more complex and Sonicawall has an interesting interface, to be polite. Good luck on getting reasonable prices?!

[-]

aguynamedbrand@reddit

I have Cisco Meraki deployed across a little over 50 sites in three countries. Would highly recommend using them.

[-]

Master-IT-All@reddit

So here's my take on this. I hate all three of those firewall vendors. Sonicwall is somehow the one I end up supporting the most often. I loath the Sonicwall UI. I sort of remember using Fortigate several years ago and finding the UI a bit slow and clunky there too. But I don't really know it well. Unifi is a pain to manage and I think your friends are right, it felt rudimentary. Sonicwall UI is messy, but at least after a day of searching you do find the feature.

[-]

Due-Swimming3221@reddit (OP)

What vendors do you like?

[-]

FACEAnthrax@reddit

Fortigate for fw, Aruba for switches is my go, the APs are easy to manage too.

[-]

teddyphreak@reddit

When doing full site revamps, Fortigate+Fortiswitch+FortiAP would be my recommendation. Update rollout toil is significantly minimized and options like implementing centralized security logging and access level controls become much easier in the future.

[-]

goblet-sama@reddit

I work for a smb we are mooving from soniwall+(cisco/aruba instant on switch)+(arubainstant on ap/unifi) to full fortinet and it's so mutch nicer to manage the security and update.

[-]

teddyphreak@reddit

The only issue I do have with Fortinet is their releases are routinely quite buggy and you need to be very careful when applying updates and read the release notes and compatibility matrix with a much more adversarial mindset than with other manufacturers, especially so the more complex you network is. We do canary releases with our Technology staff who we have been set up with separate dedicated devices for this specific purpose.

[-]

Insec_Bois@reddit

I've had to troubleshoot ubiquifi/unifi edge devices before and it's god awful, but the APs are pretty damn good in my experience. I think one of the clients at my job has unifi switches and I've never had to touch their config which is always a good sign.

[-]

Chungus-Galactic@reddit

How many devices at head office vs branch? Will you be decrypting traffic? If not, a lot of the value of “fancy” NGFWs is lost, so a Fortigate might not be much more valuable than Unifi. In this scenario, you probably have a lot of laptops, so properly locking them down and doing web filtering at end endpoint might give you the best results, plus free you up to focus on keeping the network manageable (for example, one brand for FW, switching, APs).

[-]