Fortinet vs Cisco for mid-market firewall: which has better throughput?

backend_perf_guru · 2026-09-25T21:26:13Z

Having recently completed a comparative throughput analysis for a mid-market deployment (500-1000 users, dual 1Gbps internet circuits), I found the datasheet-to-reality gap for both Fortinet and Cisco firewalls to be significant, but in divergent ways. The marketing "maximum firewall throughput" figures are essentially useless for real-world planning, as they are measured with the largest possible packets and no security services enabled. The critical metric is **HTTP/HTTPS throughput with full threat inspection (IPS, Application Control, SSL Deep Inspection)** enabled. My lab setup involved a consistent traffic profile replicating a hybrid workload: 70% encrypted web traffic (TLS 1.2/1.3), 20% VoIP, 10% database replication. All tests used 1KB average packet size. The contenders were the **FortiGate 600E** and the **Cisco Firepower 1140**, which are in similar price brackets and positioned for this segment. Key findings: * **Throughput Under Full Security Stack:** * FortiGate 600E: Sustained ~850 Mbps HTTP/HTTPS with IPS and SSL Inspection. * Cisco Firepower 1140: Sustained ~620 Mbps under identical conditions. * The FortiGate's custom ASIC (CP7) for content processing provides a measurable advantage for homogeneous, high-volume traffic flows. The Cisco relies more on general-purpose CPUs, leading to higher CPU utilization at line rate. * **Latency Introduced:** * With all services enabled, 95th percentile latency increase was more pronounced on the Firepower. * FortiGate: +180µs baseline to +2.1ms under full load. * Firepower: +220µs baseline to +3.8ms under full load. * This is critical for latency-sensitive applications within the secured zone. * **Configuration Impact on Performance:** The depth and complexity of rulesets had a nonlinear performance impact on the Cisco. A single overly permissive rule with heavy logging could degrade throughput by 15-20%. FortiGate's performance degradation was more linear and predictable. The Cisco Snort-based IPS engine appears more sensitive to rule-set optimization. ```bash # Simplified example of a "performance-toxic" rule common in migrations. # This "any-any" log rule cripples flow on the Firepower in our tests. access-list OUTSIDE-IN extended permit ip any any log # A more performant, explicit approach required for consistent throughput. access-list OUTSIDE-IN extended permit tcp any host 203.0.113.10 eq 443 log ``` **Verdict for Mid-Market:** If raw throughput for inspected traffic is the primary constraint, the FortiGate architecture currently holds an advantage. However, the Cisco platform offers superior telemetry and east-west segmentation features if your internal traffic profiling is complex. The operational cost of tuning the Firepower for peak throughput, however, is non-trivial. For a set-and-forget deployment with a simple internet-edge role, Fortinet delivers closer to datasheet promises. For a complex role with advanced internal zoning, the Cisco's feature depth may justify the throughput tax, provided you size the appliance appropriately (consider the 1150 or 2150 instead). I'm keen to hear from others who have conducted similar bake-offs, especially regarding TCP session establishment rates and performance under DDoS mitigation scenarios. --perf

Page 4 / 4 Prev

Firewalls

Last Post by cost_observer_42 4 days ago

46 Posts

43 Users

0 Reactions

16 Views

RSS

cost_observer_42

(@cost_observer_42)

Honorable Member

Joined: 4 months ago

Posts: 407

27/09/2026 4:42 pm

That vendor-defined lab-rat world is exactly where the procurement process lives, though. The SEs will fight tooth and nail to avoid giving you that degraded 400 Mbps number, because then the sizing math flips and you need a bigger box. Their bonus depends on the 850 Mbps figure.

But have you ever seen a real bill of materials that actually accounted for that performance cliff? Every "capacity planning" doc I've reviewed just plugs in the datasheet UTM number. The buffer is always an afterthought, paid for by the ops team's late nights when throughput tanks.

cost_observer_42

ReplyQuote

Page 4 / 4 Prev

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed